{"grype_matches":[{"artifact":{"id":"710c05d2086f3e55","cpes":["cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:osgi:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:osgi:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:osgi:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:osgi:osgi:42.7.2:*:*:*:*:*:*:*"],"name":"postgresql","purl":"pkg:maven/org.postgresql/postgresql@42.7.2","type":"java-archive","version":"42.7.2","language":"java","licenses":["BSD-2-Clause"],"metadata":{"pomGroupID":"org.postgresql","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/postgresql-42.7.2.jar","manifestName":"","pomArtifactID":"postgresql","archiveDigests":[{"value":"86ed42574cd68662b05d3b00432a34e9a34cb12c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/postgresql-42.7.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"42.7.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-98qh-xjc8-98pq","versionConstraint":">=42.2.0,<42.7.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.postgresql:postgresql","version":"42.7.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-98qh-xjc8-98pq","fix":{"state":"fixed","versions":["42.7.11"],"available":[{"date":"2026-05-06","kind":"first-observed","version":"42.7.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42198","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42198","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42198","date":"2026-10-08","epss":0.04117,"percentile":0.90521}],"risk":3.0877499999999998,"urls":["https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq","https://nvd.nist.gov/vuln/detail/CVE-2026-42198","https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-98qh-xjc8-98pq","description":"pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42198","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42198","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42198","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42198","date":"2026-10-08","epss":0.04117,"percentile":0.90521}],"urls":["https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11","https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq","https://access.redhat.com/errata/RHSA-2026:19098","https://access.redhat.com/errata/RHSA-2026:22304","https://access.redhat.com/errata/RHSA-2026:24348","https://access.redhat.com/errata/RHSA-2026:25030","https://access.redhat.com/errata/RHSA-2026:52928","https://access.redhat.com/errata/RHSA-2026:52929","https://access.redhat.com/errata/RHSA-2026:52930","https://access.redhat.com/errata/RHSA-2026:52978","https://access.redhat.com/errata/RHSA-2026:54532","https://access.redhat.com/errata/RHSA-2026:59277","https://access.redhat.com/errata/RHSA-2026:59278","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42198","https://bugzilla.redhat.com/show_bug.cgi?id=2463857","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42198.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42198","description":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63076","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63076","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-10-08","epss":0.01602,"percentile":0.75073}],"risk":1.2015,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63076"},"relatedVulnerabilities":[{"id":"CVE-2026-63076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-10-08","epss":0.01602,"percentile":0.75073}],"urls":["https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b","https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e","https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259","https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226","https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","description":"Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63076","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63076","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-10-08","epss":0.01602,"percentile":0.75073}],"risk":1.2015,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63076"},"relatedVulnerabilities":[{"id":"CVE-2026-63076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-10-08","epss":0.01602,"percentile":0.75073}],"urls":["https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b","https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e","https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259","https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226","https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","description":"Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63076","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63076","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63076","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-10-08","epss":0.01602,"percentile":0.75073}],"risk":1.2015,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63076"},"relatedVulnerabilities":[{"id":"CVE-2026-63076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-10-08","epss":0.01602,"percentile":0.75073}],"urls":["https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b","https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e","https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259","https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226","https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","description":"Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}]},{"artifact":{"id":"ce2e79b81950191a","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-handler-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"f79da6a81f4390ed067301235e29705a7f774c5b","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-handler-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4gw-5cx5-pgmh","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x4gw-5cx5-pgmh","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-10-08","epss":0.01576,"percentile":0.74713}],"risk":1.1820000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45416"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","description":"Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes"},"relatedVulnerabilities":[{"id":"CVE-2026-45416","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-10-08","epss":0.01576,"percentile":0.74713}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-45416","https://bugzilla.redhat.com/show_bug.cgi?id=2488391","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18798","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-18798","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18798","cwe":"CWE-415","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-18798","date":"2026-10-08","epss":0.01537,"percentile":0.74104}],"risk":1.15275,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-18798"},"relatedVulnerabilities":[{"id":"CVE-2026-18798","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18798","cwe":"CWE-415","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-18798","date":"2026-10-08","epss":0.01537,"percentile":0.74104}],"urls":["https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af","https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c","https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18798","description":"Issue summary: QUIC server may double free QRX (QUIC record layer RX) object\nwhen channel creation fails for initial packet.\n\nImpact summary: Double free leads to heap corruption, which typically results in \ntermination of QUIC server process, leading to Denial of Service. There is so\nfar no evidence that this double free is exploitable for remote code execution,\nthus it is considered highly improbable.\n\nCWE: CWE-415: Double Free\n\nDescription: In order to validate initial packet, OpenSSL QUIC stack default\npacket handler (port_default_packet_handler()) creates a so-called QRX object.\nIf the initial packet validates successfully with QRX object, the default packet\nhandler proceeds to channel (connection object) creation. The QRX object used\nfor packet validation is passed to port_bind_channel(), so it becomes part of\nthe newly created connection. If port_bind_channel() fails, then it also frees\nthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()\ndetects the failure and proceeds to the error branch, where the same QRX object is\nfreed for the second time.\n\nThe failure in port_bind_channel() function can be induced with a relatively\nlow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet\ncarries DCID (destination connection ID) which is shorter than 8 bytes, then\nport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()\ndetects that the DCID has invalid length.\n\nFIPS impact: no\nThe FIPS module is not affected, as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18798","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-18798","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18798","cwe":"CWE-415","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-18798","date":"2026-10-08","epss":0.01537,"percentile":0.74104}],"risk":1.15275,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-18798"},"relatedVulnerabilities":[{"id":"CVE-2026-18798","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18798","cwe":"CWE-415","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-18798","date":"2026-10-08","epss":0.01537,"percentile":0.74104}],"urls":["https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af","https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c","https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18798","description":"Issue summary: QUIC server may double free QRX (QUIC record layer RX) object\nwhen channel creation fails for initial packet.\n\nImpact summary: Double free leads to heap corruption, which typically results in \ntermination of QUIC server process, leading to Denial of Service. There is so\nfar no evidence that this double free is exploitable for remote code execution,\nthus it is considered highly improbable.\n\nCWE: CWE-415: Double Free\n\nDescription: In order to validate initial packet, OpenSSL QUIC stack default\npacket handler (port_default_packet_handler()) creates a so-called QRX object.\nIf the initial packet validates successfully with QRX object, the default packet\nhandler proceeds to channel (connection object) creation. The QRX object used\nfor packet validation is passed to port_bind_channel(), so it becomes part of\nthe newly created connection. If port_bind_channel() fails, then it also frees\nthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()\ndetects the failure and proceeds to the error branch, where the same QRX object is\nfreed for the second time.\n\nThe failure in port_bind_channel() function can be induced with a relatively\nlow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet\ncarries DCID (destination connection ID) which is shorter than 8 bytes, then\nport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()\ndetects that the DCID has invalid length.\n\nFIPS impact: no\nThe FIPS module is not affected, as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18798","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18798","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-18798","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18798","cwe":"CWE-415","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-18798","date":"2026-10-08","epss":0.01537,"percentile":0.74104}],"risk":1.15275,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-18798"},"relatedVulnerabilities":[{"id":"CVE-2026-18798","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18798","cwe":"CWE-415","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-18798","date":"2026-10-08","epss":0.01537,"percentile":0.74104}],"urls":["https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af","https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c","https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18798","description":"Issue summary: QUIC server may double free QRX (QUIC record layer RX) object\nwhen channel creation fails for initial packet.\n\nImpact summary: Double free leads to heap corruption, which typically results in \ntermination of QUIC server process, leading to Denial of Service. There is so\nfar no evidence that this double free is exploitable for remote code execution,\nthus it is considered highly improbable.\n\nCWE: CWE-415: Double Free\n\nDescription: In order to validate initial packet, OpenSSL QUIC stack default\npacket handler (port_default_packet_handler()) creates a so-called QRX object.\nIf the initial packet validates successfully with QRX object, the default packet\nhandler proceeds to channel (connection object) creation. The QRX object used\nfor packet validation is passed to port_bind_channel(), so it becomes part of\nthe newly created connection. If port_bind_channel() fails, then it also frees\nthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()\ndetects the failure and proceeds to the error branch, where the same QRX object is\nfreed for the second time.\n\nThe failure in port_bind_channel() function can be induced with a relatively\nlow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet\ncarries DCID (destination connection ID) which is shorter than 8 bytes, then\nport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()\ndetects that the DCID has invalid length.\n\nFIPS impact: no\nThe FIPS module is not affected, as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63073","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63073","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63073","cwe":"CWE-134","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63073","date":"2026-10-08","epss":0.01159,"percentile":0.66134}],"risk":1.08946,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63073"},"relatedVulnerabilities":[{"id":"CVE-2026-63073","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63073","cwe":"CWE-134","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63073","date":"2026-10-08","epss":0.01159,"percentile":0.66134}],"urls":["https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca","https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29","https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21","https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63073","description":"Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63073","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63073","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63073","cwe":"CWE-134","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63073","date":"2026-10-08","epss":0.01159,"percentile":0.66134}],"risk":1.08946,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63073"},"relatedVulnerabilities":[{"id":"CVE-2026-63073","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63073","cwe":"CWE-134","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63073","date":"2026-10-08","epss":0.01159,"percentile":0.66134}],"urls":["https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca","https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29","https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21","https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63073","description":"Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63073","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63073","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63073","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63073","cwe":"CWE-134","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63073","date":"2026-10-08","epss":0.01159,"percentile":0.66134}],"risk":1.08946,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63073"},"relatedVulnerabilities":[{"id":"CVE-2026-63073","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63073","cwe":"CWE-134","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63073","date":"2026-10-08","epss":0.01159,"percentile":0.66134}],"urls":["https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca","https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29","https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21","https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63073","description":"Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"5c639b53cedcb8dd","cpes":["cpe:2.3:a:apache:commons-io:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_io:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.8.0:*:*:*:*:*:*:*"],"name":"commons-io","purl":"pkg:maven/commons-io/commons-io@2.8.0","type":"java-archive","version":"2.8.0","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-io","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/velocity-engine-core-2.3.jar:commons-io:commons-io","manifestName":"","pomArtifactID":"commons-io","archiveDigests":null},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/velocity-engine-core-2.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.14.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-78wr-2p64-hpwj","versionConstraint":">=2.0,<2.14.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-io:commons-io","version":"2.8.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-78wr-2p64-hpwj","fix":{"state":"fixed","versions":["2.14.0"],"available":[{"date":"2024-10-04","kind":"first-observed","version":"2.14.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47554","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-47554","date":"2026-10-08","epss":0.01315,"percentile":0.69883}],"risk":1.0257,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-47554","https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1","http://www.openwall.com/lists/oss-security/2024/10/03/2","https://security.netapp.com/advisory/ntap-20250131-0010"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-78wr-2p64-hpwj","description":"Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader"},"relatedVulnerabilities":[{"id":"CVE-2024-47554","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47554","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-47554","date":"2026-10-08","epss":0.01315,"percentile":0.69883}],"urls":["https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1","http://www.openwall.com/lists/oss-security/2024/10/03/2","https://security.netapp.com/advisory/ntap-20250131-0010/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47554","description":"Uncontrolled Resource Consumption vulnerability in Apache Commons IO.\n\nThe org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.\n\n\nThis issue affects Apache Commons IO: from 2.0 before 2.14.0.\n\nUsers are recommended to upgrade to version 2.14.0 or later, which fixes the issue."}]},{"artifact":{"id":"ce2e79b81950191a","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-handler-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"f79da6a81f4390ed067301235e29705a7f774c5b","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-handler-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3qp7-7mw8-wx86","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3qp7-7mw8-wx86","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-10-08","epss":0.01291,"percentile":0.69378}],"risk":1.00698,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-44249"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","description":"Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking"},"relatedVulnerabilities":[{"id":"CVE-2026-44249","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-10-08","epss":0.01291,"percentile":0.69378}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44249","https://bugzilla.redhat.com/show_bug.cgi?id=2488081","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","description":"Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"9afabefc092ff440","cpes":["cpe:2.3:a:org.eclipse.jetty.http:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:http:http:12.0.17:*:*:*:*:*:*:*"],"name":"jetty-http","purl":"pkg:maven/org.eclipse.jetty/jetty-http@12.0.17","type":"java-archive","version":"12.0.17","language":"java","licenses":["https://www.eclipse.org/legal/epl-2.0/, https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jetty-http-12.0.17.jar","manifestName":"","pomArtifactID":"jetty-http","archiveDigests":[{"value":"b7d355158fb2251ef3b2a43c3afa64f219c1065f","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jetty-http-12.0.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"12.0.33"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-355h-qmc2-wpwf","versionConstraint":">=12.0.0,<=12.0.32 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-http","version":"12.0.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-355h-qmc2-wpwf","fix":{"state":"fixed","versions":["12.0.33"],"available":[{"date":"2026-04-15","kind":"first-observed","version":"12.0.33"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-2332","date":"2026-10-08","epss":0.01305,"percentile":0.69668}],"risk":0.972225,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf","https://nvd.nist.gov/vuln/detail/CVE-2026-2332","https://gitlab.eclipse.org/security/cve-assignment/-/issues/89","https://w4ke.info/2025/06/18/funky-chunks.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json","https://bugzilla.redhat.com/show_bug.cgi?id=2458187","https://access.redhat.com/security/cve/CVE-2026-2332","https://access.redhat.com/errata/RHSA-2026:50263","https://access.redhat.com/errata/RHSA-2026:50223","https://access.redhat.com/errata/RHSA-2026:50222","https://access.redhat.com/errata/RHSA-2026:50221","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:22453","https://access.redhat.com/errata/RHSA-2026:21773","https://access.redhat.com/errata/RHSA-2026:20568","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:10175"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-355h-qmc2-wpwf","description":"Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-2332","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-2332","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-2332","date":"2026-10-08","epss":0.01305,"percentile":0.69668}],"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf","https://gitlab.eclipse.org/security/cve-assignment/-/issues/89","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:20568","https://access.redhat.com/errata/RHSA-2026:21773","https://access.redhat.com/errata/RHSA-2026:22453","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:50221","https://access.redhat.com/errata/RHSA-2026:50222","https://access.redhat.com/errata/RHSA-2026:50223","https://access.redhat.com/errata/RHSA-2026:50263","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/security/cve/CVE-2026-2332","https://bugzilla.redhat.com/show_bug.cgi?id=2458187","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2332","description":"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n  *  https://w4ke.info/2025/06/18/funky-chunks.html\n\n  *  https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request."}]},{"artifact":{"id":"be1505d07c389f4e","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"d82683120b05d1c9c56a88e1daff07e4c0420537","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.11.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w9fj-cfpg-grvv","versionConstraint":">=4.2.0.Alpha1,<4.2.10.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w9fj-cfpg-grvv","fix":{"state":"fixed","versions":["4.2.11.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.2.11.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-10-08","epss":0.012,"percentile":0.6727}],"risk":0.972,"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://nvd.nist.gov/vuln/detail/CVE-2026-33871"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w9fj-cfpg-grvv","description":"Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-33871","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33871","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33871","date":"2026-10-08","epss":0.012,"percentile":0.6727}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33871","https://bugzilla.redhat.com/show_bug.cgi?id=2452456","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33871.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33871","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"903e769180d26980","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9586a7fe0e1775de0e54237fa6a2c8455c93ac06","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.19.0,<2.21.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-10-08","epss":0.01226,"percentile":0.67932}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-10-08","epss":0.01226,"percentile":0.67932}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-10-08","epss":0.01046,"percentile":0.63119}],"risk":0.7845000000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-10-08","epss":0.01046,"percentile":0.63119}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"be1505d07c389f4e","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"d82683120b05d1c9c56a88e1daff07e4c0420537","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-10-08","epss":0.01046,"percentile":0.63119}],"risk":0.7845000000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-10-08","epss":0.01046,"percentile":0.63119}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"903e769180d26980","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9586a7fe0e1775de0e54237fa6a2c8455c93ac06","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.19.0,<=2.21.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-10-08","epss":0.00999,"percentile":0.61664}],"risk":0.7792200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-10-08","epss":0.00999,"percentile":0.61664}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"369821ce4114def2","cpes":["cpe:2.3:a:giflib:giflib:5.2.2-r1:*:*:*:*:*:*:*"],"name":"giflib","purl":"pkg:apk/alpine/giflib@5.2.2-r1?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"5.2.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgif.so.7"},{"path":"/usr/lib/libgif.so.7.2.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"giflib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.2.2-r2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-26740","versionConstraint":"< 5.2.2-r2 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"giflib","version":"5.2.2-r1"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"5.2.2-r2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26740","versionConstraint":"< 5.2.2-r2 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"giflib","version":"5.2.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-26740","fix":{"state":"fixed","versions":["5.2.2-r2"],"available":[{"date":"2026-08-30","kind":"first-observed","version":"5.2.2-r2"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26740","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-26740","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-26740","date":"2026-10-08","epss":0.01029,"percentile":0.62608}],"risk":0.77175,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-26740"},"relatedVulnerabilities":[{"id":"CVE-2026-26740","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26740","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-26740","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-26740","date":"2026-10-08","epss":0.01029,"percentile":0.62608}],"urls":["https://github.com/zakkanijia/POC/blob/main/giflib/giftool/giflib_giftool_gce_len_heap_oobwrite_disclosure.md","https://access.redhat.com/errata/RHSA-2026:33447","https://access.redhat.com/errata/RHSA-2026:33450","https://access.redhat.com/errata/RHSA-2026:33451","https://access.redhat.com/errata/RHSA-2026:33452","https://access.redhat.com/errata/RHSA-2026:33455","https://access.redhat.com/errata/RHSA-2026:33456","https://access.redhat.com/errata/RHSA-2026:33501","https://access.redhat.com/errata/RHSA-2026:33502","https://access.redhat.com/errata/RHSA-2026:33503","https://access.redhat.com/errata/RHSA-2026:33509","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:9683","https://access.redhat.com/errata/RHSA-2026:9686","https://access.redhat.com/errata/RHSA-2026:9689","https://access.redhat.com/errata/RHSA-2026:9693","https://access.redhat.com/security/cve/CVE-2026-26740","https://bugzilla.redhat.com/show_bug.cgi?id=2448747","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26740.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26740","description":"Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-14457","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-14457","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14457","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14457","date":"2026-10-08","epss":0.01021,"percentile":0.62327}],"risk":0.76575,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-14457"},"relatedVulnerabilities":[{"id":"CVE-2026-14457","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14457","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14457","date":"2026-10-08","epss":0.01021,"percentile":0.62327}],"urls":["https://github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76","https://github.com/openssl/openssl/commit/581aaa0f0a35d214740f0fe1f5283ec41f1212e1","https://github.com/openssl/openssl/commit/d0af20478688a6aa2f59d61caa3f82136b181d7f","https://github.com/openssl/openssl/commit/dad836b071da6579510c968615848ba03cac593b","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14457","description":"Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)\nenabled, and only the private key (with no associated certificate) configured locally,\na NULL pointer dereference may occur when the remote peer solicits raw public keys and\nalso sends the typically omitted \"signature_algorithms_cert\" TLS extension.\n\nImpact summary: The impact is limited to a possible Denial of Service as a result of\nan application abort, no data disclosure or remote command execution are possible.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: While a passing comment in sample code in the documentation suggests\nthat key-only RPK configurations are supported, the best-practice RPK configuration\nis to always configure a corresponding certificate (possibly self-signed or\nsigned by any convenient CA).\n\nWhen the private key is configured along with a matching certificate, the\n\"signature_algorithms_cert\" extension is handled reliably even without the\nfix, and peer clients or servers that don't support raw public keys may be\nable to complete a TLS connection by pinning or verifying the corresponding\ncertificate or its public key.\n\nDeployments that prefer to configure just a private key with no certificate\nneed to upgrade to an updated release as noted below.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the SSL protocol implementation\nis outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-14457","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-14457","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14457","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14457","date":"2026-10-08","epss":0.01021,"percentile":0.62327}],"risk":0.76575,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-14457"},"relatedVulnerabilities":[{"id":"CVE-2026-14457","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14457","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14457","date":"2026-10-08","epss":0.01021,"percentile":0.62327}],"urls":["https://github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76","https://github.com/openssl/openssl/commit/581aaa0f0a35d214740f0fe1f5283ec41f1212e1","https://github.com/openssl/openssl/commit/d0af20478688a6aa2f59d61caa3f82136b181d7f","https://github.com/openssl/openssl/commit/dad836b071da6579510c968615848ba03cac593b","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14457","description":"Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)\nenabled, and only the private key (with no associated certificate) configured locally,\na NULL pointer dereference may occur when the remote peer solicits raw public keys and\nalso sends the typically omitted \"signature_algorithms_cert\" TLS extension.\n\nImpact summary: The impact is limited to a possible Denial of Service as a result of\nan application abort, no data disclosure or remote command execution are possible.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: While a passing comment in sample code in the documentation suggests\nthat key-only RPK configurations are supported, the best-practice RPK configuration\nis to always configure a corresponding certificate (possibly self-signed or\nsigned by any convenient CA).\n\nWhen the private key is configured along with a matching certificate, the\n\"signature_algorithms_cert\" extension is handled reliably even without the\nfix, and peer clients or servers that don't support raw public keys may be\nable to complete a TLS connection by pinning or verifying the corresponding\ncertificate or its public key.\n\nDeployments that prefer to configure just a private key with no certificate\nneed to upgrade to an updated release as noted below.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the SSL protocol implementation\nis outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-14457","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-14457","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-14457","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14457","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14457","date":"2026-10-08","epss":0.01021,"percentile":0.62327}],"risk":0.76575,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-14457"},"relatedVulnerabilities":[{"id":"CVE-2026-14457","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14457","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14457","date":"2026-10-08","epss":0.01021,"percentile":0.62327}],"urls":["https://github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76","https://github.com/openssl/openssl/commit/581aaa0f0a35d214740f0fe1f5283ec41f1212e1","https://github.com/openssl/openssl/commit/d0af20478688a6aa2f59d61caa3f82136b181d7f","https://github.com/openssl/openssl/commit/dad836b071da6579510c968615848ba03cac593b","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14457","description":"Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)\nenabled, and only the private key (with no associated certificate) configured locally,\na NULL pointer dereference may occur when the remote peer solicits raw public keys and\nalso sends the typically omitted \"signature_algorithms_cert\" TLS extension.\n\nImpact summary: The impact is limited to a possible Denial of Service as a result of\nan application abort, no data disclosure or remote command execution are possible.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: While a passing comment in sample code in the documentation suggests\nthat key-only RPK configurations are supported, the best-practice RPK configuration\nis to always configure a corresponding certificate (possibly self-signed or\nsigned by any convenient CA).\n\nWhen the private key is configured along with a matching certificate, the\n\"signature_algorithms_cert\" extension is handled reliably even without the\nfix, and peer clients or servers that don't support raw public keys may be\nable to complete a TLS connection by pinning or verifying the corresponding\ncertificate or its public key.\n\nDeployments that prefer to configure just a private key with no certificate\nneed to upgrade to an updated release as noted below.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the SSL protocol implementation\nis outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"4f128e5363ae9974","cpes":["cpe:2.3:a:bouncycastle-org:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpg-jdk15to18:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpg-jdk15to18:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpg_jdk15to18:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpg_jdk15to18:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpg:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpg:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*"],"name":"bcpg-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcpg-jdk15to18@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcpg-jdk15to18-1.81.jar","manifestName":"","pomArtifactID":"bcpg-jdk15to18","archiveDigests":[{"value":"3cf0703481e16bbf576fb393f8680848f72c628e","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcpg-jdk15to18-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cj8j-37rh-8475","versionConstraint":"<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcpg-jdk15to18","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cj8j-37rh-8475","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-18","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3505","cwe":"CWE-400","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-3505","cwe":"CWE-770","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-3505","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-3505","date":"2026-10-08","epss":0.00882,"percentile":0.57906}],"risk":0.7144199999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-3505","https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c1","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cj8j-37rh-8475","description":"Bouncy Castle Uncontrolled Resource Consumption vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-3505","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3505","cwe":"CWE-400","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-3505","cwe":"CWE-770","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-3505","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-3505","date":"2026-10-08","epss":0.00882,"percentile":0.57906}],"urls":["https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c1","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/security/cve/CVE-2026-3505","https://bugzilla.redhat.com/show_bug.cgi?id=2458638","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3505.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3505","description":"Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).\n\n This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"402f989a5c52bb95","cpes":["cpe:2.3:a:curl:curl:8.21.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19931","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19931","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-19931","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-08","epss":0.00747,"percentile":0.53447}],"risk":0.70218,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-19931"},"relatedVulnerabilities":[{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-08","epss":0.00747,"percentile":0.53447}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"a2647272222f5e72","cpes":["cpe:2.3:a:libcurl:libcurl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1&upstream=curl","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19931","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-19931","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-08","epss":0.00747,"percentile":0.53447}],"risk":0.70218,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-19931"},"relatedVulnerabilities":[{"id":"CVE-2026-19931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-08","epss":0.00747,"percentile":0.53447}],"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"risk":0.6869999999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"risk":0.6869999999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"risk":0.6869999999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"402f989a5c52bb95","cpes":["cpe:2.3:a:curl:curl:8.21.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80231","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80231","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-80231","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80231","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80231","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80231","date":"2026-10-08","epss":0.00898,"percentile":0.58384}],"risk":0.6735,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-80231"},"relatedVulnerabilities":[{"id":"CVE-2026-80231","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80231","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80231","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80231","date":"2026-10-08","epss":0.00898,"percentile":0.58384}],"urls":["https://curl.se/docs/CVE-2026-80231.html","https://curl.se/docs/CVE-2026-80231.json","https://hackerone.com/reports/3969368"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80231","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created."}]},{"artifact":{"id":"a2647272222f5e72","cpes":["cpe:2.3:a:libcurl:libcurl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1&upstream=curl","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80231","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-80231","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80231","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80231","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80231","date":"2026-10-08","epss":0.00898,"percentile":0.58384}],"risk":0.6735,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-80231"},"relatedVulnerabilities":[{"id":"CVE-2026-80231","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80231","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80231","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80231","date":"2026-10-08","epss":0.00898,"percentile":0.58384}],"urls":["https://curl.se/docs/CVE-2026-80231.html","https://curl.se/docs/CVE-2026-80231.json","https://hackerone.com/reports/3969368"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80231","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created."}]},{"artifact":{"id":"2e058fb271e28b3d","cpes":["cpe:2.3:a:io.netty.codec-dns:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-dns:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-dns:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-dns:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_dns:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-dns","purl":"pkg:maven/io.netty/netty-codec-dns@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-dns-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-dns","archiveDigests":[{"value":"94e72675257d9dffa405f0e989de6acda962fed1","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-dns-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cm33-6792-r9fm","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-dns","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cm33-6792-r9fm","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42579","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-626","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42579","date":"2026-10-08","epss":0.00847,"percentile":0.56787}],"risk":0.6352500000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm","https://tools.ietf.org/html/rfc1035#section-2.3.4","https://tools.ietf.org/html/rfc1035#section-4.1.4","https://nvd.nist.gov/vuln/detail/CVE-2026-42579"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cm33-6792-r9fm","description":"Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)"},"relatedVulnerabilities":[{"id":"CVE-2026-42579","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42579","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-626","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42579","date":"2026-10-08","epss":0.00847,"percentile":0.56787}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/security/cve/CVE-2026-42579","https://bugzilla.redhat.com/show_bug.cgi?id=2477217","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42579.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42579","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"27567eed7ed30a6a","cpes":["cpe:2.3:a:apache:shiro-core:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro_core:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:1.13.0:*:*:*:*:*:*:*"],"name":"shiro-core","purl":"pkg:maven/org.apache.shiro/shiro-core@1.13.0","type":"java-archive","version":"1.13.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.shiro","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/shiro-core-1.13.0.jar","manifestName":"","pomArtifactID":"shiro-core","archiveDigests":[{"value":"7e542e3d614b197bf10005e98e19f9f19cb943e7","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/shiro-core-1.13.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.2.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x96m-rh44-vgv8","versionConstraint":"<2.2.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.shiro:shiro-core","version":"1.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x96m-rh44-vgv8","fix":{"state":"fixed","versions":["2.2.1"],"available":[{"date":"2026-06-19","kind":"first-observed","version":"2.2.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L/U:Red","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49268","cwe":"CWE-90","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-49268","date":"2026-10-08","epss":0.00755,"percentile":0.5372}],"risk":0.6153250000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-49268","https://lists.apache.org/thread/svszql3od8td7hn6conyj2oq70v53b5s","http://www.openwall.com/lists/oss-security/2026/06/17/8"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x96m-rh44-vgv8","description":"Apache Shiro: LDAP DN Injection in DefaultLdapRealm"},"relatedVulnerabilities":[{"id":"CVE-2026-49268","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:Red","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49268","cwe":"CWE-90","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-49268","date":"2026-10-08","epss":0.00755,"percentile":0.5372}],"urls":["https://lists.apache.org/thread/svszql3od8td7hn6conyj2oq70v53b5s","http://www.openwall.com/lists/oss-security/2026/06/17/8"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49268","description":"A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.\n\nThis issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm\nUpgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63075","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63075","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63075","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63075","date":"2026-10-08","epss":0.00778,"percentile":0.5448}],"risk":0.5835,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63075"},"relatedVulnerabilities":[{"id":"CVE-2026-63075","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63075","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63075","date":"2026-10-08","epss":0.00778,"percentile":0.5448}],"urls":["https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc","https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709","https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6","https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63075","description":"Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly\nsends ack-eliciting packets while not acknowledging ACK-only responses, the\nQUIC stack can retain ACK-only packet metadata for the lifetime of the\nconnection.\n\nImpact summary: A remote peer that can complete a QUIC handshake can\ncause connection-scoped memory growth which may lead to Denial of Service\nthrough memory exhaustion, especially with sustained traffic or many concurrent\nQUIC connections.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: When the OpenSSL QUIC stack sends an ACK-only packet,\nthere is no requirement by the QUIC protocol that the peer will acknowledge\nthat ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL\nimplementation stores the metadata about the ACK frames regardless.\nIn and of itself that's ok, but if a malicious peer establishes a connection, and\nthen drives the connection such that ACK-only packets are forced from the \nOpenSSL implementation peer (i.e., by sending numerous PING frames),\nand then withholding any subsequent acks for ack-eliciting data, like\nlegitimate data, said malicious peer can force inappropriate memory growth\non the OpenSSL peer, potentially leading to a Denial of Service.\n\nThe fix is to ensure that we account for the transmission of the ACK-only\npacket in the packet histories high and low watermark without actually storing\nthe ACK-only packet metadata itself.\n\nFIPS impact: no\nThe OpenSSL FIPS module is not affected as the QUIC code is\noutside the FIPS module boundary."}]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63075","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63075","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63075","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63075","date":"2026-10-08","epss":0.00778,"percentile":0.5448}],"risk":0.5835,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63075"},"relatedVulnerabilities":[{"id":"CVE-2026-63075","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63075","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63075","date":"2026-10-08","epss":0.00778,"percentile":0.5448}],"urls":["https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc","https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709","https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6","https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63075","description":"Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly\nsends ack-eliciting packets while not acknowledging ACK-only responses, the\nQUIC stack can retain ACK-only packet metadata for the lifetime of the\nconnection.\n\nImpact summary: A remote peer that can complete a QUIC handshake can\ncause connection-scoped memory growth which may lead to Denial of Service\nthrough memory exhaustion, especially with sustained traffic or many concurrent\nQUIC connections.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: When the OpenSSL QUIC stack sends an ACK-only packet,\nthere is no requirement by the QUIC protocol that the peer will acknowledge\nthat ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL\nimplementation stores the metadata about the ACK frames regardless.\nIn and of itself that's ok, but if a malicious peer establishes a connection, and\nthen drives the connection such that ACK-only packets are forced from the \nOpenSSL implementation peer (i.e., by sending numerous PING frames),\nand then withholding any subsequent acks for ack-eliciting data, like\nlegitimate data, said malicious peer can force inappropriate memory growth\non the OpenSSL peer, potentially leading to a Denial of Service.\n\nThe fix is to ensure that we account for the transmission of the ACK-only\npacket in the packet histories high and low watermark without actually storing\nthe ACK-only packet metadata itself.\n\nFIPS impact: no\nThe OpenSSL FIPS module is not affected as the QUIC code is\noutside the FIPS module boundary."}]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63075","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63075","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63075","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63075","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63075","date":"2026-10-08","epss":0.00778,"percentile":0.5448}],"risk":0.5835,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63075"},"relatedVulnerabilities":[{"id":"CVE-2026-63075","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63075","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63075","date":"2026-10-08","epss":0.00778,"percentile":0.5448}],"urls":["https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc","https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709","https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6","https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63075","description":"Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly\nsends ack-eliciting packets while not acknowledging ACK-only responses, the\nQUIC stack can retain ACK-only packet metadata for the lifetime of the\nconnection.\n\nImpact summary: A remote peer that can complete a QUIC handshake can\ncause connection-scoped memory growth which may lead to Denial of Service\nthrough memory exhaustion, especially with sustained traffic or many concurrent\nQUIC connections.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: When the OpenSSL QUIC stack sends an ACK-only packet,\nthere is no requirement by the QUIC protocol that the peer will acknowledge\nthat ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL\nimplementation stores the metadata about the ACK frames regardless.\nIn and of itself that's ok, but if a malicious peer establishes a connection, and\nthen drives the connection such that ACK-only packets are forced from the \nOpenSSL implementation peer (i.e., by sending numerous PING frames),\nand then withholding any subsequent acks for ack-eliciting data, like\nlegitimate data, said malicious peer can force inappropriate memory growth\non the OpenSSL peer, potentially leading to a Denial of Service.\n\nThe fix is to ensure that we account for the transmission of the ACK-only\npacket in the packet histories high and low watermark without actually storing\nthe ACK-only packet metadata itself.\n\nFIPS impact: no\nThe OpenSSL FIPS module is not affected as the QUIC code is\noutside the FIPS module boundary."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-14456","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-14456","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14456","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14456","date":"2026-10-08","epss":0.00729,"percentile":0.52813}],"risk":0.5467500000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-14456"},"relatedVulnerabilities":[{"id":"CVE-2026-14456","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14456","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14456","date":"2026-10-08","epss":0.00729,"percentile":0.52813}],"urls":["https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","https://openssl-library.org/news/secadv/20260813.txt","http://www.openwall.com/lists/oss-security/2026/08/13/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14456","description":"Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-14456","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-14456","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14456","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14456","date":"2026-10-08","epss":0.00729,"percentile":0.52813}],"risk":0.5467500000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-14456"},"relatedVulnerabilities":[{"id":"CVE-2026-14456","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14456","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14456","date":"2026-10-08","epss":0.00729,"percentile":0.52813}],"urls":["https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","https://openssl-library.org/news/secadv/20260813.txt","http://www.openwall.com/lists/oss-security/2026/08/13/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14456","description":"Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-14456","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-14456","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-14456","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14456","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14456","date":"2026-10-08","epss":0.00729,"percentile":0.52813}],"risk":0.5467500000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-14456"},"relatedVulnerabilities":[{"id":"CVE-2026-14456","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14456","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14456","date":"2026-10-08","epss":0.00729,"percentile":0.52813}],"urls":["https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","https://openssl-library.org/news/secadv/20260813.txt","http://www.openwall.com/lists/oss-security/2026/08/13/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14456","description":"Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"ce2e79b81950191a","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-handler-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"f79da6a81f4390ed067301235e29705a7f774c5b","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-handler-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c653-97m9-rcg9","versionConstraint":">=4.2.0.Final,<4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c653-97m9-rcg9","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-50010","date":"2026-10-08","epss":0.00721,"percentile":0.52529}],"risk":0.54075,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","https://nvd.nist.gov/vuln/detail/CVE-2026-50010","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c653-97m9-rcg9","description":"Netty: Wrapping plain trust manager silently disables hostname verification"},"relatedVulnerabilities":[{"id":"CVE-2026-50010","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-50010","date":"2026-10-08","epss":0.00721,"percentile":0.52529}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-50010","https://bugzilla.redhat.com/show_bug.cgi?id=2488429","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50010.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50010","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm=\"HTTPS\" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57rv-r2g8-2cj3","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57rv-r2g8-2cj3","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-10-08","epss":0.00716,"percentile":0.52318}],"risk":0.52984,"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://nvd.nist.gov/vuln/detail/CVE-2026-42584"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","description":"Netty has HttpClientCodec response desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-42584","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-10-08","epss":0.00716,"percentile":0.52318}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42584","https://bugzilla.redhat.com/show_bug.cgi?id=2477224","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"402f989a5c52bb95","cpes":["cpe:2.3:a:curl:curl:8.21.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-08","epss":0.00584,"percentile":0.46233}],"risk":0.52852,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-18924"},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-08","epss":0.00584,"percentile":0.46233}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"a2647272222f5e72","cpes":["cpe:2.3:a:libcurl:libcurl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1&upstream=curl","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-08","epss":0.00584,"percentile":0.46233}],"risk":0.52852,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-18924"},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-08","epss":0.00584,"percentile":0.46233}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.10.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pwqr-wmgm-9rr8","versionConstraint":">=4.2.0.Alpha1,<4.2.10.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pwqr-wmgm-9rr8","fix":{"state":"fixed","versions":["4.2.10.Final"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"4.2.10.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-10-08","epss":0.00698,"percentile":0.516}],"risk":0.5235,"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://nvd.nist.gov/vuln/detail/CVE-2026-33870"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8","description":"Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-33870","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33870","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33870","date":"2026-10-08","epss":0.00698,"percentile":0.516}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/errata/RHSA-2026:8159","https://access.redhat.com/errata/RHSA-2026:8509","https://access.redhat.com/security/cve/CVE-2026-33870","https://bugzilla.redhat.com/show_bug.cgi?id=2452453","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","description":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue."}]},{"artifact":{"id":"120643e90646e54d","cpes":["cpe:2.3:a:org.eclipse.jetty.ee8.security:jetty-ee8-security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8.security:jetty_ee8_security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty-ee8-security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty_ee8_security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty-ee8-security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty_ee8_security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8:jetty-ee8-security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8:jetty_ee8_security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8.security:security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8-security:jetty-ee8-security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8-security:jetty_ee8_security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8_security:jetty-ee8-security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8_security:jetty_ee8_security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8.security:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8:security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8:jetty-ee8-security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8:jetty_ee8_security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8:jetty-ee8-security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8:jetty_ee8_security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8-security:security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8_security:security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:security:jetty-ee8-security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:security:jetty_ee8_security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-ee8-security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_ee8_security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8-security:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-ee8-security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_ee8_security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8_security:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:ee8:jetty-ee8-security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:ee8:jetty_ee8_security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8:security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8:security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:security:security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:security:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:ee8:security:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:ee8:jetty:12.0.17:*:*:*:*:*:*:*"],"name":"jetty-ee8-security","purl":"pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-security@12.0.17","type":"java-archive","version":"12.0.17","language":"java","licenses":["https://www.eclipse.org/legal/epl-2.0/, https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"org.eclipse.jetty.ee8","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jetty-ee8-security-12.0.17.jar","manifestName":"","pomArtifactID":"jetty-ee8-security","archiveDigests":[{"value":"91d06ebb5513e577ab2ef2b2858ab320136ca794","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jetty-ee8-security-12.0.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"12.0.36"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fvj-hgj9-j2gr","versionConstraint":">=12.0.0,<=12.0.35 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty.ee8:jetty-ee8-security","version":"12.0.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2fvj-hgj9-j2gr","fix":{"state":"fixed","versions":["12.0.36"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"12.0.36"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10050","cwe":"CWE-173","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-10050","cwe":"CWE-303","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-10050","date":"2026-10-08","epss":0.00632,"percentile":0.48697}],"risk":0.51192,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr","https://github.com/jetty/jetty.project/issues/15136","https://github.com/jetty/jetty.project/pull/15160","https://github.com/jetty/jetty.project/pull/15183","https://github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d","https://github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d","https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36","https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fvj-hgj9-j2gr","description":"Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution"},"relatedVulnerabilities":[{"id":"CVE-2026-10050","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10050","cwe":"CWE-173","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-10050","cwe":"CWE-303","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-10050","date":"2026-10-08","epss":0.00632,"percentile":0.48697}],"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10050","description":"In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.\n\n\n\nRecent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-08","epss":0.0063,"percentile":0.4857}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-08","epss":0.0063,"percentile":0.4857}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-08","epss":0.00665,"percentile":0.50259}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-08","epss":0.00665,"percentile":0.50259}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-08","epss":0.00665,"percentile":0.50259}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-08","epss":0.00665,"percentile":0.50259}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"be1505d07c389f4e","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"d82683120b05d1c9c56a88e1daff07e4c0420537","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93wv-jw9v-4972","versionConstraint":">=4.2.0,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-93wv-jw9v-4972","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-08-01","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-10-08","epss":0.00665,"percentile":0.50259}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972","https://nvd.nist.gov/vuln/detail/CVE-2026-56819","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93wv-jw9v-4972","description":"Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-56819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-10-08","epss":0.00665,"percentile":0.50259}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56819","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"5a173766feef3636","cpes":["cpe:2.3:a:org.codehaus.plexus:plexus-utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:org.codehaus.plexus:plexus_utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:org.codehaus.plexus:plexus:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus-utils:plexus-utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus-utils:plexus_utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus_utils:plexus-utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus_utils:plexus_utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:codehaus:plexus-utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:codehaus:plexus_utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus-utils:plexus:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus:plexus-utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus:plexus_utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus_utils:plexus:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:codehaus:plexus:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus:plexus:3.5.1:*:*:*:*:*:*:*"],"name":"plexus-utils","purl":"pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1","type":"java-archive","version":"3.5.1","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.codehaus.plexus","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/plexus-utils-3.5.1.jar","manifestName":"","pomArtifactID":"plexus-utils","archiveDigests":[{"value":"c6bfb17c97ecc8863e88778ea301be742c62b06d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/plexus-utils-3.5.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.6.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6fmv-xxpf-w3cw","versionConstraint":"<3.6.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.codehaus.plexus:plexus-utils","version":"3.5.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6fmv-xxpf-w3cw","fix":{"state":"fixed","versions":["3.6.1"],"available":[{"date":"2026-04-09","kind":"first-observed","version":"3.6.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-67030","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-67030","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-67030","date":"2026-10-08","epss":0.00663,"percentile":0.50153}],"risk":0.49724999999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-67030","https://github.com/codehaus-plexus/plexus-utils/issues/294","https://github.com/codehaus-plexus/plexus-utils/pull/295","https://github.com/codehaus-plexus/plexus-utils/pull/296","https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642","https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec","https://github.com/codehaus-plexus/plexus-utils/releases/tag/plexus-utils-4.0.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6fmv-xxpf-w3cw","description":"Plexus-Utils has a Directory Traversal vulnerability in its extractFile method"},"relatedVulnerabilities":[{"id":"CVE-2025-67030","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":8.3,"impactScore":3.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-67030","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-67030","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-67030","date":"2026-10-08","epss":0.00663,"percentile":0.50153}],"urls":["https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec","https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642","https://github.com/codehaus-plexus/plexus-utils/issues/294","https://github.com/codehaus-plexus/plexus-utils/pull/295","https://github.com/codehaus-plexus/plexus-utils/pull/296","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:35990","https://access.redhat.com/errata/RHSA-2026:35991","https://access.redhat.com/errata/RHSA-2026:35992","https://access.redhat.com/errata/RHSA-2026:35996","https://access.redhat.com/errata/RHSA-2026:35997","https://access.redhat.com/errata/RHSA-2026:36012","https://access.redhat.com/errata/RHSA-2026:38500","https://access.redhat.com/errata/RHSA-2026:38514","https://access.redhat.com/errata/RHSA-2026:38796","https://access.redhat.com/errata/RHSA-2026:40841","https://access.redhat.com/errata/RHSA-2026:41948","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/security/cve/CVE-2025-67030","https://bugzilla.redhat.com/show_bug.cgi?id=2451409","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67030.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-67030","description":"Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code"}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54874","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-54874","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"risk":0.46649999999999997,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-54874"},"relatedVulnerabilities":[{"id":"CVE-2026-54874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"}]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54874","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-54874","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"risk":0.46649999999999997,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-54874"},"relatedVulnerabilities":[{"id":"CVE-2026-54874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"}]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-54874","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54874","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-54874","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"risk":0.46649999999999997,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-54874"},"relatedVulnerabilities":[{"id":"CVE-2026-54874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"}]},{"artifact":{"id":"af643dc8653a70bf","cpes":["cpe:2.3:a:apache:log4j-api:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_api:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:api:2.19.0:*:*:*:*:*:*:*"],"name":"log4j-api","purl":"pkg:maven/org.apache.logging.log4j/log4j-api@2.19.0","type":"java-archive","version":"2.19.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/log4j-api-2.19.0.jar","manifestName":"","pomArtifactID":"log4j-api","archiveDigests":[{"value":"ea1b37f38c327596b216542bc636cfdc0b8036fa","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/log4j-api-2.19.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qv9r-c865-cp47","versionConstraint":">=2.13.1,<2.25.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-api","version":"2.19.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qv9r-c865-cp47","fix":{"state":"fixed","versions":["2.25.5"],"available":[{"date":"2026-08-14","kind":"first-observed","version":"2.25.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49844","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-49844","date":"2026-10-08","epss":0.00813,"percentile":0.55707}],"risk":0.459345,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-49844","https://github.com/apache/logging-log4j2/pull/4163","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message","https://logging.apache.org/security.html#CVE-2026-49844","https://github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300","https://github.com/apache/logging-log4j2/commit/feadf8eb0b4acb6ddfa4c0ab2bbc6d88b8e12d82","https://github.com/apache/logging-log4j2/releases/tag/rel/2.25.5","https://github.com/apache/logging-log4j2/releases/tag/rel/2.26.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qv9r-c865-cp47","description":"Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization"},"relatedVulnerabilities":[{"id":"CVE-2026-49844","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49844","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-49844","date":"2026-10-08","epss":0.00813,"percentile":0.55707}],"urls":["https://github.com/apache/logging-log4j2/pull/4163","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message","https://logging.apache.org/security.html#CVE-2026-49844"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49844","description":"Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\n  *  The application uses the  message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message  of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{\"JSON\"}).\n  *  The application logs a MapMessage that contains an attacker-controlled floating-point value.\n\n\nAn attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.\n\nUsers are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values."}]},{"artifact":{"id":"be1505d07c389f4e","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"d82683120b05d1c9c56a88e1daff07e4c0420537","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c2gf-v879-257j","versionConstraint":">=4.2.0.Alpha1,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c2gf-v879-257j","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-11","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-10-08","epss":0.00882,"percentile":0.57908}],"risk":0.45423,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://nvd.nist.gov/vuln/detail/CVE-2026-48043","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645","https://github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25e","https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c2gf-v879-257j","description":"netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-48043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-10-08","epss":0.00882,"percentile":0.57908}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48043","description":"Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"c7d1534b9ff1837a","cpes":["cpe:2.3:a:io.netty.transport-classes-epoll:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-classes-epoll:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes-epoll:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes-epoll:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes_epoll:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes_epoll:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-classes-epoll:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-classes-epoll:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes-epoll:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes-epoll:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes_epoll:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes_epoll:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes-epoll:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes-epoll:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes_epoll:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes_epoll:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes-epoll:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes-epoll:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes_epoll:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes_epoll:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:transport-classes-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:transport_classes_epoll:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-transport-classes-epoll","purl":"pkg:maven/io.netty/netty-transport-classes-epoll@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-transport-classes-epoll-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-transport-classes-epoll","archiveDigests":[{"value":"334ba203f5b5ac6372286d27115605431e5a37d3","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-transport-classes-epoll-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rwm7-x88c-3g2p","versionConstraint":">=4.2.0.Final,<4.2.13.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-transport-classes-epoll","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rwm7-x88c-3g2p","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-07-25","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42577","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42577","date":"2026-10-08","epss":0.00583,"percentile":0.46186}],"risk":0.43724999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-rwm7-x88c-3g2p","https://github.com/netty/netty/pull/16689","https://github.com/netty/netty/commit/0ec3d97fab376e243d328ac95fbd288ba0f6e22d","https://nvd.nist.gov/vuln/detail/CVE-2026-42577"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rwm7-x88c-3g2p","description":"Netty epoll transport denial of service via RST on half-closed TCP connection"},"relatedVulnerabilities":[{"id":"CVE-2026-42577","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42577","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42577","date":"2026-10-08","epss":0.00583,"percentile":0.46186}],"urls":["https://github.com/netty/netty/commit/0ec3d97fab376e243d328ac95fbd288ba0f6e22d","https://github.com/netty/netty/pull/16689","https://github.com/netty/netty/security/advisories/GHSA-rwm7-x88c-3g2p"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42577","description":"Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread. This vulnerability is fixed in 4.2.13.Final."}]},{"artifact":{"id":"903e769180d26980","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9586a7fe0e1775de0e54237fa6a2c8455c93ac06","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.19.0,<2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.21.6"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.21.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-08","epss":0.00581,"percentile":0.46036}],"risk":0.43575,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-08","epss":0.00581,"percentile":0.46036}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"f74a0a96746e4842","cpes":["cpe:2.3:a:org.springframework.security:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.6:*:*:*:*:*:*:*"],"name":"spring-security-web","purl":"pkg:maven/org.springframework.security/spring-security-web@6.5.6","type":"java-archive","version":"6.5.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-web-6.5.6.jar","manifestName":"","pomArtifactID":"spring-security-web","archiveDigests":[{"value":"7428000af55e700e10c0378cad694ed23fda59be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-web-6.5.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mf92-479x-3373","versionConstraint":">=6.5.0,<6.5.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-web","version":"6.5.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mf92-479x-3373","fix":{"state":"fixed","versions":["6.5.9"],"available":[{"date":"2026-03-21","kind":"first-observed","version":"6.5.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22732","cwe":"CWE-425","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-22732","date":"2026-10-08","epss":0.0048,"percentile":0.39471}],"risk":0.43439999999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-22732","https://spring.io/security/cve-2026-22732"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mf92-479x-3373","description":"Spring Security HTTP Headers Are not Written Under Some Conditions"},"relatedVulnerabilities":[{"id":"CVE-2026-22732","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22732","cwe":"CWE-425","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-22732","date":"2026-10-08","epss":0.0048,"percentile":0.39471}],"urls":["https://spring.io/security/cve-2026-22732"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22732","description":"When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. \nThis issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:\n\n: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3."}]},{"artifact":{"id":"402f989a5c52bb95","cpes":["cpe:2.3:a:curl:curl:8.21.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80229","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80229","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-80229","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80229","date":"2026-10-08","epss":0.00563,"percentile":0.45051}],"risk":0.42224999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-80229"},"relatedVulnerabilities":[{"id":"CVE-2026-80229","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80229","date":"2026-10-08","epss":0.00563,"percentile":0.45051}],"urls":["https://curl.se/docs/CVE-2026-80229.html","https://curl.se/docs/CVE-2026-80229.json","https://hackerone.com/reports/3969255"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80229","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations."}]},{"artifact":{"id":"a2647272222f5e72","cpes":["cpe:2.3:a:libcurl:libcurl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1&upstream=curl","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80229","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-80229","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80229","date":"2026-10-08","epss":0.00563,"percentile":0.45051}],"risk":0.42224999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-80229"},"relatedVulnerabilities":[{"id":"CVE-2026-80229","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80229","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80229","date":"2026-10-08","epss":0.00563,"percentile":0.45051}],"urls":["https://curl.se/docs/CVE-2026-80229.html","https://curl.se/docs/CVE-2026-80229.json","https://hackerone.com/reports/3969255"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80229","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations."}]},{"artifact":{"id":"976d7815b2e90949","cpes":["cpe:2.3:a:jonathan-hedley:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jonathan_hedley:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:org.jsoup:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jsoup:jsoup:1.15.3:*:*:*:*:*:*:*"],"name":"jsoup","purl":"pkg:maven/org.jsoup/jsoup@1.15.3","type":"java-archive","version":"1.15.3","language":"java","licenses":["https://jsoup.org/license"],"metadata":{"pomGroupID":"org.jsoup","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jsoup-1.15.3.jar","manifestName":"","pomArtifactID":"jsoup","archiveDigests":[{"value":"f6e1d8a8819f854b681c8eaa57fd59a42329e10c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jsoup-1.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-65r4-943x-97jj","versionConstraint":"<1.23.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jsoup:jsoup","version":"1.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-65r4-943x-97jj","fix":{"state":"fixed","versions":["1.23.2"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"1.23.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-10-08","epss":0.00525,"percentile":0.42712}],"risk":0.40950000000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-75140","https://github.com/jhy/jsoup/pull/2556","https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-65r4-943x-97jj","description":"jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations"},"relatedVulnerabilities":[{"id":"CVE-2026-75140","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-10-08","epss":0.00525,"percentile":0.42712}],"urls":["https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://github.com/jhy/jsoup/pull/2556","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75140","description":"jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application."}]},{"artifact":{"id":"3d10807f633e7ff7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-core-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"5734323adfece72111769b0ae38a6cf803e3d178","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-core-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.19.0,<=2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.21.7"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.21.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-08","epss":0.00546,"percentile":0.44031}],"risk":0.4095,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-08","epss":0.00546,"percentile":0.44031}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"44bc47f6eab197e1","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-08","epss":0.0043,"percentile":0.35225}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-08","epss":0.0043,"percentile":0.35225}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"83e7f044e8f34c76","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"e5961a1649ee994ed27009ec04778356d0b1292d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-08","epss":0.0043,"percentile":0.35225}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-08","epss":0.0043,"percentile":0.35225}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"5decbc644b4f1955","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*"],"name":"bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on@1.81.1","type":"java-archive","version":"1.81.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk18on-1.81.1.jar","manifestName":"","pomArtifactID":"bcprov-jdk18on","archiveDigests":[{"value":"07bcb4c4664600c51190ab3774710a51bfdeb2eb","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk18on-1.81.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk18on","version":"1.81.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-08","epss":0.0043,"percentile":0.35225}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-08","epss":0.0043,"percentile":0.35225}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"b1279d760587ff99","cpes":["cpe:2.3:a:bcpkix-jdk15to18:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix-jdk15to18:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix_jdk15to18:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix_jdk15to18:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*"],"name":"bcpkix-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcpkix-jdk15to18@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcpkix-jdk15to18-1.81.jar","manifestName":"","pomArtifactID":"bcpkix-jdk15to18","archiveDigests":[{"value":"c332d3508cf24dea645c303db2dddf5cc5b44c15","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcpkix-jdk15to18-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wg6q-6289-32hp","versionConstraint":">=1.49,<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcpkix-jdk15to18","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wg6q-6289-32hp","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-17","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5588","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5588","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5588","date":"2026-10-08","epss":0.00687,"percentile":0.51185}],"risk":0.388155,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-5588","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wg6q-6289-32hp","description":"Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules"},"relatedVulnerabilities":[{"id":"CVE-2026-5588","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5588","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5588","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5588","date":"2026-10-08","epss":0.00687,"percentile":0.51185}],"urls":["https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-5588","https://bugzilla.redhat.com/show_bug.cgi?id=2458634","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5588.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5588","description":"Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).\n\n This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11."}]},{"artifact":{"id":"86ba56f766210486","cpes":["cpe:2.3:a:org.bouncycastle:bcpkix-jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpkix_jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix-jdk18on:bcpkix-jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix-jdk18on:bcpkix_jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix_jdk18on:bcpkix-jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix_jdk18on:bcpkix_jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpkix-jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpkix_jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix:bcpkix-jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix:bcpkix_jdk18on:1.81:*:*:*:*:*:*:*"],"name":"bcpkix-jdk18on","purl":"pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcpkix-jdk18on-1.81.jar","manifestName":"","pomArtifactID":"bcpkix-jdk18on","archiveDigests":[{"value":"819fd6f5d170c8b8bf8c5acc73816e9c36574042","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcpkix-jdk18on-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wg6q-6289-32hp","versionConstraint":">=1.49,<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcpkix-jdk18on","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wg6q-6289-32hp","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-17","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5588","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5588","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5588","date":"2026-10-08","epss":0.00687,"percentile":0.51185}],"risk":0.388155,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-5588","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wg6q-6289-32hp","description":"Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules"},"relatedVulnerabilities":[{"id":"CVE-2026-5588","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5588","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5588","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5588","date":"2026-10-08","epss":0.00687,"percentile":0.51185}],"urls":["https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-5588","https://bugzilla.redhat.com/show_bug.cgi?id=2458634","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5588.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5588","description":"Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).\n\n This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11."}]},{"artifact":{"id":"903e769180d26980","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9586a7fe0e1775de0e54237fa6a2c8455c93ac06","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.19.0,<2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.21.6"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.21.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-08","epss":0.00717,"percentile":0.52375}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-08","epss":0.00717,"percentile":0.52375}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"3d10807f633e7ff7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-core-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"5734323adfece72111769b0ae38a6cf803e3d178","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-core-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":">=2.19.0,<2.21.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-10-08","epss":0.00463,"percentile":0.38164}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-10-08","epss":0.00463,"percentile":0.38164}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"5aca21e8e15aeac4","cpes":["cpe:2.3:a:io.netty.codec-compression:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-compression:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-compression:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-compression:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_compression:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-compression","purl":"pkg:maven/io.netty/netty-codec-compression@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-compression-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-compression","archiveDigests":[{"value":"d3d3c3c16110278d1dbf8a423e20a839523724cd","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-compression-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-558v-64gr-wgg4","versionConstraint":">=4.2.0.Final,<4.2.16.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-compression","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-558v-64gr-wgg4","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-08","epss":0.0046,"percentile":0.37877}],"risk":0.3726,"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-558v-64gr-wgg4","description":"Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang"},"relatedVulnerabilities":[{"id":"CVE-2026-59901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-08","epss":0.0046,"percentile":0.37877}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59901","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xxqh-mfjm-7mv9","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xxqh-mfjm-7mv9","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42581","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42581","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42581","date":"2026-10-08","epss":0.00684,"percentile":0.51071}],"risk":0.36936,"urls":["https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9","https://nvd.nist.gov/vuln/detail/CVE-2026-42581"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xxqh-mfjm-7mv9","description":"Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization"},"relatedVulnerabilities":[{"id":"CVE-2026-42581","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42581","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42581","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42581","date":"2026-10-08","epss":0.00684,"percentile":0.51071}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42581","https://bugzilla.redhat.com/show_bug.cgi?id=2477232","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42581.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42581","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"3d10807f633e7ff7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-core-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"5734323adfece72111769b0ae38a6cf803e3d178","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-core-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.19.0,<=2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.21.7"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.21.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-08","epss":0.00492,"percentile":0.4033}],"risk":0.369,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-08","epss":0.00492,"percentile":0.4033}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"5aca21e8e15aeac4","cpes":["cpe:2.3:a:io.netty.codec-compression:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-compression:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-compression:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-compression:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-compression:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_compression:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-compression","purl":"pkg:maven/io.netty/netty-codec-compression@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-compression-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-compression","archiveDigests":[{"value":"d3d3c3c16110278d1dbf8a423e20a839523724cd","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-compression-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mj4r-2hfc-f8p6","versionConstraint":"<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-compression","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mj4r-2hfc-f8p6","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42583","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42583","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42583","date":"2026-10-08","epss":0.00486,"percentile":0.39915}],"risk":0.3645,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6","https://nvd.nist.gov/vuln/detail/CVE-2026-42583"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mj4r-2hfc-f8p6","description":"Netty Lz4FrameDecoder is vulnerable to resource exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-42583","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42583","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42583","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42583","date":"2026-10-08","epss":0.00486,"percentile":0.39915}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42583","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4f6-jm68-57ww","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4f6-jm68-57ww","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-08","epss":0.00609,"percentile":0.47536}],"risk":0.362355,"urls":["https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","description":"Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2026-59899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-08","epss":0.00609,"percentile":0.47536}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"402f989a5c52bb95","cpes":["cpe:2.3:a:curl:curl:8.21.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80255","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80255","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-80255","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80255","date":"2026-10-08","epss":0.00478,"percentile":0.39331}],"risk":0.35850000000000004,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-80255"},"relatedVulnerabilities":[{"id":"CVE-2026-80255","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80255","date":"2026-10-08","epss":0.00478,"percentile":0.39331}],"urls":["https://curl.se/docs/CVE-2026-80255.html","https://curl.se/docs/CVE-2026-80255.json","https://hackerone.com/reports/3972395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80255","description":"A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of\nspace (ascii code 32) immediately before the `Secure` attribute causes curl to\nstore the cookie without its Secure flag. The cookie might then wrongfully be\nsent over plaintext HTTP on subsequent requests to the same host."}]},{"artifact":{"id":"a2647272222f5e72","cpes":["cpe:2.3:a:libcurl:libcurl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1&upstream=curl","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80255","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-80255","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80255","date":"2026-10-08","epss":0.00478,"percentile":0.39331}],"risk":0.35850000000000004,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-80255"},"relatedVulnerabilities":[{"id":"CVE-2026-80255","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80255","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80255","date":"2026-10-08","epss":0.00478,"percentile":0.39331}],"urls":["https://curl.se/docs/CVE-2026-80255.html","https://curl.se/docs/CVE-2026-80255.json","https://hackerone.com/reports/3972395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80255","description":"A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of\nspace (ascii code 32) immediately before the `Secure` attribute causes curl to\nstore the cookie without its Secure flag. The cookie might then wrongfully be\nsent over plaintext HTTP on subsequent requests to the same host."}]},{"artifact":{"id":"402f989a5c52bb95","cpes":["cpe:2.3:a:curl:curl:8.21.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-13608","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13608","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-13608","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-08","epss":0.00479,"percentile":0.39377}],"risk":0.356855,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-13608"},"relatedVulnerabilities":[{"id":"CVE-2026-13608","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-08","epss":0.00479,"percentile":0.39377}],"urls":["https://curl.se/docs/CVE-2026-13608.html","https://curl.se/docs/CVE-2026-13608.json","https://hackerone.com/reports/3822248"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13608","description":"A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}]},{"artifact":{"id":"a2647272222f5e72","cpes":["cpe:2.3:a:libcurl:libcurl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1&upstream=curl","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13608","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-13608","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-08","epss":0.00479,"percentile":0.39377}],"risk":0.356855,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-13608"},"relatedVulnerabilities":[{"id":"CVE-2026-13608","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-13608","cwe":"CWE-923","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-13608","date":"2026-10-08","epss":0.00479,"percentile":0.39377}],"urls":["https://curl.se/docs/CVE-2026-13608.html","https://curl.se/docs/CVE-2026-13608.json","https://hackerone.com/reports/3822248"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13608","description":"A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}]},{"artifact":{"id":"44bc47f6eab197e1","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v6w3-qrh8-qccc","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v6w3-qrh8-qccc","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8798","cwe":"CWE-835","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8798","date":"2026-10-08","epss":0.00428,"percentile":0.35041}],"risk":0.34668,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8798","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908798"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v6w3-qrh8-qccc","description":"Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound"},"relatedVulnerabilities":[{"id":"CVE-2026-8798","cvss":[{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8798","cwe":"CWE-835","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8798","date":"2026-10-08","epss":0.00428,"percentile":0.35041}],"urls":["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8798","description":"In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long as that flag stayed clear, so a persistent failure of the on-chip entropy source - whether from a hardware fault, from the underlying DRBG being exhausted by contention across many cores, or from a hypervisor that does not provide the instruction - left the calling thread looping indefinitely inside the JNI call, where it could be neither interrupted nor timed out. Any operation drawing from the native entropy source could therefore hang, denying service to the application. The retry loops are now bounded (200 attempts for RDSEED and 20 for RDRAND, twice the baselines given in Intel's Digital Random Number Generator software implementation guide), pausing between attempts and, on exhaustion, clearing any partially written buffer and throwing rather than continuing to spin. The clear is performed by an un-elidable memzero, which uses a volatile pointer and an assembly memory barrier so that a compiler cannot optimise the erase away as a dead store. Bouncy Castle for Java (bcprov) is not affected, as it has no native entropy source; the 1.0.X and 2.0.X FIPS series are not affected."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54873","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54873","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-08","epss":0.00462,"percentile":0.38098}],"risk":0.34650000000000003,"urls":["https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54873","description":"Issue summary: QUIC process may keep memory for QUIC packet\nbuffer for much longer period than necessary.\n\nImpact summary: Remote peer can exploit this vulnerability\nby sending maliciously crafted packets, making the local\nQUIC stack to keep the memory for packet buffers allocated.\nThe time for which the memory remains allocated is entirely\nunder the control of the potentially malicious remote peer.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: To save copy operation from the packet buffer to the\nstream reassemble buffer the QUIC stack leaves the stream data\non the packet buffer waiting to be copied to a buffer provided\nby the local receiving application. The QUIC stack releases\na reference to the packet buffer only after the data are copied\nto the application buffer. This design is more efficient for\nlegitimate data transfers but enables an attacker to allocate a lot\nmore memory than actually required by the data kept in the receiving\nstream buffer.\n\nTo mitigate the vulnerability, the QUIC stack now calculates\nand monitors memory overhead for every stream. The memory overhead\nfor a single stream frame is calculated as a difference between the\nsize of the whole packet that carries the stream frame and the size\nof the stream frame itself. The memory overhead for a single stream\nframe is added to the total (cumulative) memory overhead QUIC stack\nkeeps for each stream. Once the cumulative memory overhead exceeds\n64kB, the QUIC stack moves the stream frame data from the packet\nbuffer to the stream buffer, starting with the next packet received.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54873","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54873","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-08","epss":0.00462,"percentile":0.38098}],"risk":0.34650000000000003,"urls":["https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54873","description":"Issue summary: QUIC process may keep memory for QUIC packet\nbuffer for much longer period than necessary.\n\nImpact summary: Remote peer can exploit this vulnerability\nby sending maliciously crafted packets, making the local\nQUIC stack to keep the memory for packet buffers allocated.\nThe time for which the memory remains allocated is entirely\nunder the control of the potentially malicious remote peer.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: To save copy operation from the packet buffer to the\nstream reassemble buffer the QUIC stack leaves the stream data\non the packet buffer waiting to be copied to a buffer provided\nby the local receiving application. The QUIC stack releases\na reference to the packet buffer only after the data are copied\nto the application buffer. This design is more efficient for\nlegitimate data transfers but enables an attacker to allocate a lot\nmore memory than actually required by the data kept in the receiving\nstream buffer.\n\nTo mitigate the vulnerability, the QUIC stack now calculates\nand monitors memory overhead for every stream. The memory overhead\nfor a single stream frame is calculated as a difference between the\nsize of the whole packet that carries the stream frame and the size\nof the stream frame itself. The memory overhead for a single stream\nframe is added to the total (cumulative) memory overhead QUIC stack\nkeeps for each stream. Once the cumulative memory overhead exceeds\n64kB, the QUIC stack moves the stream frame data from the packet\nbuffer to the stream buffer, starting with the next packet received.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54873","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54873","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54873","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54873","date":"2026-10-08","epss":0.00462,"percentile":0.38098}],"risk":0.34650000000000003,"urls":["https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54873","description":"Issue summary: QUIC process may keep memory for QUIC packet\nbuffer for much longer period than necessary.\n\nImpact summary: Remote peer can exploit this vulnerability\nby sending maliciously crafted packets, making the local\nQUIC stack to keep the memory for packet buffers allocated.\nThe time for which the memory remains allocated is entirely\nunder the control of the potentially malicious remote peer.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: To save copy operation from the packet buffer to the\nstream reassemble buffer the QUIC stack leaves the stream data\non the packet buffer waiting to be copied to a buffer provided\nby the local receiving application. The QUIC stack releases\na reference to the packet buffer only after the data are copied\nto the application buffer. This design is more efficient for\nlegitimate data transfers but enables an attacker to allocate a lot\nmore memory than actually required by the data kept in the receiving\nstream buffer.\n\nTo mitigate the vulnerability, the QUIC stack now calculates\nand monitors memory overhead for every stream. The memory overhead\nfor a single stream frame is calculated as a difference between the\nsize of the whole packet that carries the stream frame and the size\nof the stream frame itself. The memory overhead for a single stream\nframe is added to the total (cumulative) memory overhead QUIC stack\nkeeps for each stream. Once the cumulative memory overhead exceeds\n64kB, the QUIC stack moves the stream frame data from the packet\nbuffer to the stream buffer, starting with the next packet received.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"d915eaa34f2bddf6","cpes":["cpe:2.3:a:spring-security-saml2-service-provider:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service-provider:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service-provider:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.6:*:*:*:*:*:*:*"],"name":"spring-security-saml2-service-provider","purl":"pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.6","type":"java-archive","version":"6.5.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-saml2-service-provider-6.5.6.jar","manifestName":"","pomArtifactID":"spring-security-saml2-service-provider","archiveDigests":[{"value":"c1db9cba3dac366d16162dc7a71f3a42146bbd8d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-saml2-service-provider-6.5.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m69x-pw9p-7j3q","versionConstraint":">=6.5.0,<=6.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-saml2-service-provider","version":"6.5.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-m69x-pw9p-7j3q","fix":{"state":"fixed","versions":["6.5.11"],"available":[{"date":"2026-08-12","kind":"first-observed","version":"6.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40988","cwe":"CWE-400","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-40988","date":"2026-10-08","epss":0.0046,"percentile":0.37903}],"risk":0.345,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-40988","https://spring.io/security/cve-2026-40988","https://github.com/spring-projects/spring-security/releases/tag/6.5.11","https://github.com/spring-projects/spring-security/releases/tag/7.0.6"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m69x-pw9p-7j3q","description":"Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-40988","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40988","cwe":"CWE-400","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-40988","date":"2026-10-08","epss":0.0046,"percentile":0.37903}],"urls":["https://spring.io/security/cve-2026-40988"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40988","description":"An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory.\n\nAffected versions:\nSpring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5."}]},{"artifact":{"id":"640a0ea1e3caeec6","cpes":["cpe:2.3:a:org.springframework:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring_expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring_expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_expression:6.2.11:*:*:*:*:*:*:*"],"name":"spring-expression","purl":"pkg:maven/org.springframework/spring-expression@6.2.11","type":"java-archive","version":"6.2.11","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-expression-6.2.11.jar","manifestName":"","pomArtifactID":"spring-expression","archiveDigests":[{"value":"7190c1c69576516efef1a061d956dccf17cb0b86","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-expression-6.2.11.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r5w3-xv2f-j59q","versionConstraint":">=6.2.0,<=6.2.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-expression","version":"6.2.11"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r5w3-xv2f-j59q","fix":{"state":"fixed","versions":["6.2.19"],"available":[{"date":"2026-07-31","kind":"first-observed","version":"6.2.19"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41850","cwe":"CWE-407","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41850","date":"2026-10-08","epss":0.0046,"percentile":0.3787}],"risk":0.345,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41850","https://spring.io/security/cve-2026-41850","https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19","https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r5w3-xv2f-j59q","description":"Spring Framework Algorithmic Denial of Service via SpEL Expressions"},"relatedVulnerabilities":[{"id":"CVE-2026-41850","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41850","cwe":"CWE-407","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41850","date":"2026-10-08","epss":0.0046,"percentile":0.3787}],"urls":["https://spring.io/security/cve-2026-41850"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41850","description":"Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48."}]},{"artifact":{"id":"44bc47f6eab197e1","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-08","epss":0.00442,"percentile":0.36375}],"risk":0.34476,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-08","epss":0.00442,"percentile":0.36375}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"83e7f044e8f34c76","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"e5961a1649ee994ed27009ec04778356d0b1292d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-08","epss":0.00442,"percentile":0.36375}],"risk":0.34476,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-08","epss":0.00442,"percentile":0.36375}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"5decbc644b4f1955","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*"],"name":"bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on@1.81.1","type":"java-archive","version":"1.81.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk18on-1.81.1.jar","manifestName":"","pomArtifactID":"bcprov-jdk18on","archiveDigests":[{"value":"07bcb4c4664600c51190ab3774710a51bfdeb2eb","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk18on-1.81.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk18on","version":"1.81.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-08","epss":0.00442,"percentile":0.36375}],"risk":0.34476,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-08","epss":0.00442,"percentile":0.36375}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"4d93320920ed4ac9","cpes":["cpe:2.3:a:io.netty.handler-proxy:netty-handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler-proxy:netty_handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler-proxy:netty-handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler-proxy:netty_handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler_proxy:netty-handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler_proxy:netty_handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler-proxy:handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler-proxy:handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler-proxy:netty-handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler-proxy:netty_handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler_proxy:netty-handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler_proxy:netty_handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler-proxy:handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler-proxy:handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler_proxy:handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler_proxy:handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler-proxy:handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler-proxy:handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler_proxy:handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler_proxy:handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler_proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler-proxy:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler_proxy:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-handler-proxy","purl":"pkg:maven/io.netty/netty-handler-proxy@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-handler-proxy-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-handler-proxy","archiveDigests":[{"value":"3be91239e18159d66b647c8025629e13986236e4","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-handler-proxy-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-45q3-82m4-75jr","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler-proxy","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-45q3-82m4-75jr","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42578","cwe":"CWE-113","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42578","cwe":"CWE-93","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42578","date":"2026-10-08","epss":0.01153,"percentile":0.66002}],"risk":0.340135,"urls":["https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr","https://github.com/advisories/GHSA-84h7-rjj3-6jx4","https://nvd.nist.gov/vuln/detail/CVE-2026-42578"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-45q3-82m4-75jr","description":"Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)"},"relatedVulnerabilities":[{"id":"CVE-2026-42578","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42578","cwe":"CWE-113","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42578","cwe":"CWE-93","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42578","date":"2026-10-08","epss":0.01153,"percentile":0.66002}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42578","https://bugzilla.redhat.com/show_bug.cgi?id=2477226","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42578.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42578","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"903e769180d26980","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9586a7fe0e1775de0e54237fa6a2c8455c93ac06","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.19.0,<=2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.21.7"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.21.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-08","epss":0.0045,"percentile":0.3713}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-08","epss":0.0045,"percentile":0.3713}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"903e769180d26980","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9586a7fe0e1775de0e54237fa6a2c8455c93ac06","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.19.0,<=2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.21.7"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.21.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-08","epss":0.0045,"percentile":0.3713}],"risk":0.33749999999999997,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-08","epss":0.0045,"percentile":0.3713}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63074","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63074","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63074","date":"2026-10-08","epss":0.00588,"percentile":0.46424}],"risk":0.32046,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63074"},"relatedVulnerabilities":[{"id":"CVE-2026-63074","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63074","date":"2026-10-08","epss":0.00588,"percentile":0.46424}],"urls":["https://github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7","https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f","https://github.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46","https://github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54af","https://github.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43a","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63074","description":"Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\nadditional certificates (extraCerts) sent in a CMP message, but never expunges\nthem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTX\nfrequently, this cache of extraCerts may grow unboundedly, and a malicious\nclient may flood a CMP server with requests driving this growth.\n\nImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\nfor the lifetime of a server process may observe unbounded memory growth in the\nevent a malicious client repeatedly sends requests containing unique extra\ncertificates, which may lead to OOM conditions.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: If a remote user sends CMP messages to a server with a list of\nextraCerts and the message is rejected, the extraCerts from the message remains\nin the server contexts untrusted certificate stack.  This exposes servers with\nlong lived ctx objects to Denial of Service attacks in which an attacker sends\nmessages intending to be rejected with a large list of additional certificates\nrepeatedly, forcing the server to store them indefinitely.\n   \nThe issue was fixed by removing the added extra certs if the message is\nrejected, using the same method as when the context is configured to not do\ncaching at all.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63074","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63074","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63074","date":"2026-10-08","epss":0.00588,"percentile":0.46424}],"risk":0.32046,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63074"},"relatedVulnerabilities":[{"id":"CVE-2026-63074","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63074","date":"2026-10-08","epss":0.00588,"percentile":0.46424}],"urls":["https://github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7","https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f","https://github.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46","https://github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54af","https://github.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43a","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63074","description":"Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\nadditional certificates (extraCerts) sent in a CMP message, but never expunges\nthem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTX\nfrequently, this cache of extraCerts may grow unboundedly, and a malicious\nclient may flood a CMP server with requests driving this growth.\n\nImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\nfor the lifetime of a server process may observe unbounded memory growth in the\nevent a malicious client repeatedly sends requests containing unique extra\ncertificates, which may lead to OOM conditions.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: If a remote user sends CMP messages to a server with a list of\nextraCerts and the message is rejected, the extraCerts from the message remains\nin the server contexts untrusted certificate stack.  This exposes servers with\nlong lived ctx objects to Denial of Service attacks in which an attacker sends\nmessages intending to be rejected with a large list of additional certificates\nrepeatedly, forcing the server to store them indefinitely.\n   \nThe issue was fixed by removing the added extra certs if the message is\nrejected, using the same method as when the context is configured to not do\ncaching at all.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63074","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63074","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-63074","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63074","date":"2026-10-08","epss":0.00588,"percentile":0.46424}],"risk":0.32046,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-63074"},"relatedVulnerabilities":[{"id":"CVE-2026-63074","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63074","date":"2026-10-08","epss":0.00588,"percentile":0.46424}],"urls":["https://github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7","https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f","https://github.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46","https://github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54af","https://github.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43a","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63074","description":"Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\nadditional certificates (extraCerts) sent in a CMP message, but never expunges\nthem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTX\nfrequently, this cache of extraCerts may grow unboundedly, and a malicious\nclient may flood a CMP server with requests driving this growth.\n\nImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\nfor the lifetime of a server process may observe unbounded memory growth in the\nevent a malicious client repeatedly sends requests containing unique extra\ncertificates, which may lead to OOM conditions.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: If a remote user sends CMP messages to a server with a list of\nextraCerts and the message is rejected, the extraCerts from the message remains\nin the server contexts untrusted certificate stack.  This exposes servers with\nlong lived ctx objects to Denial of Service attacks in which an attacker sends\nmessages intending to be rejected with a large list of additional certificates\nrepeatedly, forcing the server to store them indefinitely.\n   \nThe issue was fixed by removing the added extra certs if the message is\nrejected, using the same method as when the context is configured to not do\ncaching at all.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-84782","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-08","epss":0.0039,"percentile":0.31045}],"risk":0.30615,"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-84782","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-08","epss":0.0039,"percentile":0.31045}],"risk":0.30615,"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-84782","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-08","epss":0.0039,"percentile":0.31045}],"risk":0.30615,"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"402f989a5c52bb95","cpes":["cpe:2.3:a:curl:curl:8.21.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82208","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82208","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-82208","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82208","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82208","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82208","date":"2026-10-08","epss":0.00407,"percentile":0.3292}],"risk":0.30524999999999997,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-82208"},"relatedVulnerabilities":[{"id":"CVE-2026-82208","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82208","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82208","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82208","date":"2026-10-08","epss":0.00407,"percentile":0.3292}],"urls":["https://curl.se/docs/CVE-2026-82208.html","https://curl.se/docs/CVE-2026-82208.json","https://hackerone.com/reports/3973090"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82208","description":"With the wolfSSL backend, when CA caching is enabled and an\n`CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can\nsilently reinstall the cached store after the callback returns. A certificate\ntrusted by the cached store but rejected by the callback-selected store is\nthen incorrectly accepted."}]},{"artifact":{"id":"a2647272222f5e72","cpes":["cpe:2.3:a:libcurl:libcurl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1&upstream=curl","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82208","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-82208","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82208","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82208","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82208","date":"2026-10-08","epss":0.00407,"percentile":0.3292}],"risk":0.30524999999999997,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-82208"},"relatedVulnerabilities":[{"id":"CVE-2026-82208","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82208","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82208","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82208","date":"2026-10-08","epss":0.00407,"percentile":0.3292}],"urls":["https://curl.se/docs/CVE-2026-82208.html","https://curl.se/docs/CVE-2026-82208.json","https://hackerone.com/reports/3973090"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82208","description":"With the wolfSSL backend, when CA caching is enabled and an\n`CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can\nsilently reinstall the cached store after the callback returns. A certificate\ntrusted by the cached store but rejected by the callback-selected store is\nthen incorrectly accepted."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-84784","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-84784","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84784","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84784","date":"2026-10-08","epss":0.00403,"percentile":0.32493}],"risk":0.30225,"urls":["https://github.com/openssl/openssl/commit/4685c914b0d410b1034f40b547c95bc95e7a380a","https://github.com/openssl/openssl/commit/9a30fe0fba195c14e5b87bf93c0d0fdb70373806","https://github.com/openssl/openssl/commit/dba3c48d653c64fcbc9070a17a0ee2b3e2f3af1f","https://github.com/openssl/openssl/commit/e9e5155833fa968bee50024bf9ca3a185ab599fe","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84784","description":"Issue summary: A malicious remote peer may flood the local QUIC\nstack with NEW_CONNECTION_ID frames by avoiding a limit check on\nhow many connection IDs the remote QUIC stack can use.\n\nImpact summary: The local QUIC stack sends a RETIRE_CONN_ID frame\nfor every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID\nframe is dispatched via the Control Frame Queue (CFQ). If the remote\npeer also withholds ACKs, then it can force the local stack\nto allocate ~400MB (depending on ACK delay).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism\nby which a remote peer can notify the local QUIC stack to change the\ndestination connection ID (a.k.a. CID) the local stack uses to\nidentify the connection at the remote peer. Each CID is associated\nwith a sequence number. The sequence number is transmitted\nin NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID\nwhich is being either associated with a connection or retired.\n\nThe remote peer sends a NEW_CONNECTION_ID frame to let the local stack know\na new CID is being associated with an existing connection. The\nNEW_CONNECTION_ID frame carries the new CID, its sequence number, and the\nretire-prior-to number. The retire-prior-to identifies existing\nCIDs that are to be retired. The local QUIC stack must send a\nRETIRE_CONNECTION_ID for every destination CID whose sequence number\nis less than retire-prior-to. The CID becomes retired after the\nlocal stack receives an ACK for its RETIRE_CONNECTION_ID frame.\n\nAlthough the OpenSSL QUIC stack supports at most one destination CID\nfor every connection, it can be tricked into processing more than\none RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC\nstack currently retires the destination CID as soon as it receives\nthe NEW_CONNECTION_ID, while in fact the destination CID must\nbe retired after an ACK for the RETIRE_CONNECTION_ID frame is received.\nCorrecting the flawed logic also fixes the backlog growth.\n\n[1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-84784","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-84784","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84784","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84784","date":"2026-10-08","epss":0.00403,"percentile":0.32493}],"risk":0.30225,"urls":["https://github.com/openssl/openssl/commit/4685c914b0d410b1034f40b547c95bc95e7a380a","https://github.com/openssl/openssl/commit/9a30fe0fba195c14e5b87bf93c0d0fdb70373806","https://github.com/openssl/openssl/commit/dba3c48d653c64fcbc9070a17a0ee2b3e2f3af1f","https://github.com/openssl/openssl/commit/e9e5155833fa968bee50024bf9ca3a185ab599fe","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84784","description":"Issue summary: A malicious remote peer may flood the local QUIC\nstack with NEW_CONNECTION_ID frames by avoiding a limit check on\nhow many connection IDs the remote QUIC stack can use.\n\nImpact summary: The local QUIC stack sends a RETIRE_CONN_ID frame\nfor every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID\nframe is dispatched via the Control Frame Queue (CFQ). If the remote\npeer also withholds ACKs, then it can force the local stack\nto allocate ~400MB (depending on ACK delay).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism\nby which a remote peer can notify the local QUIC stack to change the\ndestination connection ID (a.k.a. CID) the local stack uses to\nidentify the connection at the remote peer. Each CID is associated\nwith a sequence number. The sequence number is transmitted\nin NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID\nwhich is being either associated with a connection or retired.\n\nThe remote peer sends a NEW_CONNECTION_ID frame to let the local stack know\na new CID is being associated with an existing connection. The\nNEW_CONNECTION_ID frame carries the new CID, its sequence number, and the\nretire-prior-to number. The retire-prior-to identifies existing\nCIDs that are to be retired. The local QUIC stack must send a\nRETIRE_CONNECTION_ID for every destination CID whose sequence number\nis less than retire-prior-to. The CID becomes retired after the\nlocal stack receives an ACK for its RETIRE_CONNECTION_ID frame.\n\nAlthough the OpenSSL QUIC stack supports at most one destination CID\nfor every connection, it can be tricked into processing more than\none RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC\nstack currently retires the destination CID as soon as it receives\nthe NEW_CONNECTION_ID, while in fact the destination CID must\nbe retired after an ACK for the RETIRE_CONNECTION_ID frame is received.\nCorrecting the flawed logic also fixes the backlog growth.\n\n[1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-84784","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-84784","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84784","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84784","date":"2026-10-08","epss":0.00403,"percentile":0.32493}],"risk":0.30225,"urls":["https://github.com/openssl/openssl/commit/4685c914b0d410b1034f40b547c95bc95e7a380a","https://github.com/openssl/openssl/commit/9a30fe0fba195c14e5b87bf93c0d0fdb70373806","https://github.com/openssl/openssl/commit/dba3c48d653c64fcbc9070a17a0ee2b3e2f3af1f","https://github.com/openssl/openssl/commit/e9e5155833fa968bee50024bf9ca3a185ab599fe","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84784","description":"Issue summary: A malicious remote peer may flood the local QUIC\nstack with NEW_CONNECTION_ID frames by avoiding a limit check on\nhow many connection IDs the remote QUIC stack can use.\n\nImpact summary: The local QUIC stack sends a RETIRE_CONN_ID frame\nfor every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID\nframe is dispatched via the Control Frame Queue (CFQ). If the remote\npeer also withholds ACKs, then it can force the local stack\nto allocate ~400MB (depending on ACK delay).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism\nby which a remote peer can notify the local QUIC stack to change the\ndestination connection ID (a.k.a. CID) the local stack uses to\nidentify the connection at the remote peer. Each CID is associated\nwith a sequence number. The sequence number is transmitted\nin NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID\nwhich is being either associated with a connection or retired.\n\nThe remote peer sends a NEW_CONNECTION_ID frame to let the local stack know\na new CID is being associated with an existing connection. The\nNEW_CONNECTION_ID frame carries the new CID, its sequence number, and the\nretire-prior-to number. The retire-prior-to identifies existing\nCIDs that are to be retired. The local QUIC stack must send a\nRETIRE_CONNECTION_ID for every destination CID whose sequence number\nis less than retire-prior-to. The CID becomes retired after the\nlocal stack receives an ACK for its RETIRE_CONNECTION_ID frame.\n\nAlthough the OpenSSL QUIC stack supports at most one destination CID\nfor every connection, it can be tricked into processing more than\none RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC\nstack currently retires the destination CID as soon as it receives\nthe NEW_CONNECTION_ID, while in fact the destination CID must\nbe retired after an ACK for the RETIRE_CONNECTION_ID frame is received.\nCorrecting the flawed logic also fixes the backlog growth.\n\n[1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"402f989a5c52bb95","cpes":["cpe:2.3:a:curl:curl:8.21.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-08","epss":0.00373,"percentile":0.29191}],"risk":0.292805,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-82209"},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-08","epss":0.00373,"percentile":0.29191}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"a2647272222f5e72","cpes":["cpe:2.3:a:libcurl:libcurl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1&upstream=curl","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-08","epss":0.00373,"percentile":0.29191}],"risk":0.292805,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-82209"},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-08","epss":0.00373,"percentile":0.29191}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"be1505d07c389f4e","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"d82683120b05d1c9c56a88e1daff07e4c0420537","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-563q-j3cm-6jxm","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-563q-j3cm-6jxm","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50560","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50560","date":"2026-10-08","epss":0.00524,"percentile":0.42611}],"risk":0.29081999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm","https://nvd.nist.gov/vuln/detail/CVE-2026-50560","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-563q-j3cm-6jxm","description":"Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature"},"relatedVulnerabilities":[{"id":"CVE-2026-50560","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50560","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50560","date":"2026-10-08","epss":0.00524,"percentile":0.42611}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm","https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50560","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"ba127fa905fad417","cpes":["cpe:2.3:a:io.netty.resolver-dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-resolver-dns","purl":"pkg:maven/io.netty/netty-resolver-dns@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-resolver-dns-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-resolver-dns","archiveDigests":[{"value":"565e7ff1266db445b6b1621b2f68015bf20b5406","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-resolver-dns-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5pvg-856g-cp85","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-resolver-dns","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5pvg-856g-cp85","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47691","cwe":"CWE-345","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-47691","cwe":"CWE-346","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-47691","date":"2026-10-08","epss":0.00358,"percentile":0.27449}],"risk":0.28997999999999996,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-47691","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-47691","https://bugzilla.redhat.com/show_bug.cgi?id=2488439","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47691.json","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5pvg-856g-cp85","description":"Netty has Insufficient Bailiwick Validation for NS Records"},"relatedVulnerabilities":[{"id":"CVE-2026-47691","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":10,"impactScore":5.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47691","cwe":"CWE-345","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-47691","cwe":"CWE-346","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-47691","date":"2026-10-08","epss":0.00358,"percentile":0.27449}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/security/cve/CVE-2026-47691","https://bugzilla.redhat.com/show_bug.cgi?id=2488439","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47691.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47691","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"27567eed7ed30a6a","cpes":["cpe:2.3:a:apache:shiro-core:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro_core:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:1.13.0:*:*:*:*:*:*:*"],"name":"shiro-core","purl":"pkg:maven/org.apache.shiro/shiro-core@1.13.0","type":"java-archive","version":"1.13.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.shiro","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/shiro-core-1.13.0.jar","manifestName":"","pomArtifactID":"shiro-core","archiveDigests":[{"value":"7e542e3d614b197bf10005e98e19f9f19cb943e7","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/shiro-core-1.13.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fcvm-3cpj-f9qx","versionConstraint":">=1.0.0-incubating,<2.2.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.shiro:shiro-core","version":"1.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fcvm-3cpj-f9qx","fix":{"state":"fixed","versions":["2.2.0"],"available":[{"date":"2026-07-01","kind":"first-observed","version":"2.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/RE:L/U:Amber","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43827","cwe":"CWE-384","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-43827","date":"2026-10-08","epss":0.0053,"percentile":0.43055}],"risk":0.28885,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-43827","https://shiro.apache.org/security-reports.html#cve_2026_43827","http://www.openwall.com/lists/oss-security/2026/05/25/6"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fcvm-3cpj-f9qx","description":"Apache Shiro has a session fixation vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-43827","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43827","cwe":"CWE-384","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-43827","date":"2026-10-08","epss":0.0053,"percentile":0.43055}],"urls":["https://shiro.apache.org/security-reports.html#cve_2026_43827","http://www.openwall.com/lists/oss-security/2026/05/25/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-43827","description":"Default configurations of Apache Shiro have a session fixation vulnerability.\n\nThis issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.\n\nUsers are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.\n\nIn the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID."}]},{"artifact":{"id":"eb222fe89d397776","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r0:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"1.3.2-r0","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libz.so.1"},{"path":"/usr/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.3.2-r1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1.3.2-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"zlib","version":"1.3.2-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.3.2-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1.3.2-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"zlib","version":"1.3.2-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"fixed","versions":["1.3.2-r1"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.3.2-r1"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-08","epss":0.00356,"percentile":0.27225}],"risk":0.28124,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-85091"},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-08","epss":0.00356,"percentile":0.27225}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"83e7f044e8f34c76","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"e5961a1649ee994ed27009ec04778356d0b1292d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-574f-3g2m-x479","versionConstraint":"=1.81.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-574f-3g2m-x479","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-14813","date":"2026-10-08","epss":0.0032,"percentile":0.22914}],"risk":0.27840000000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-14813","https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3","https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json","https://bugzilla.redhat.com/show_bug.cgi?id=2458640","https://access.redhat.com/security/cve/CVE-2025-14813","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-574f-3g2m-x479","description":"Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks"},"relatedVulnerabilities":[{"id":"CVE-2025-14813","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Red","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-14813","date":"2026-10-08","epss":0.0032,"percentile":0.22914}],"urls":["https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3","https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2025-14813","https://bugzilla.redhat.com/show_bug.cgi?id=2458640","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14813","description":": Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).\n\n This vulnerability is associated with program files G3413CTRBlockCipher.\n\n\n\nThis issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"402f989a5c52bb95","cpes":["cpe:2.3:a:curl:curl:8.21.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-08","epss":0.00371,"percentile":0.29002}],"risk":0.27825,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-80230"},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-08","epss":0.00371,"percentile":0.29002}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"a2647272222f5e72","cpes":["cpe:2.3:a:libcurl:libcurl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1&upstream=curl","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-08","epss":0.00371,"percentile":0.29002}],"risk":0.27825,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-80230"},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-08","epss":0.00371,"percentile":0.29002}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"83e7f044e8f34c76","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"e5961a1649ee994ed27009ec04778356d0b1292d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c3fc-8qff-9hwx","versionConstraint":">=1.74,<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c3fc-8qff-9hwx","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-18","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0636","date":"2026-10-08","epss":0.00527,"percentile":0.42855}],"risk":0.276675,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-0636","https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c3fc-8qff-9hwx","description":"Bouncy Castle has an LDAP injection"},"relatedVulnerabilities":[{"id":"CVE-2026-0636","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0636","date":"2026-10-08","epss":0.00527,"percentile":0.42855}],"urls":["https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-0636","https://bugzilla.redhat.com/show_bug.cgi?id=2458641","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0636","description":"Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).\n\n This vulnerability is associated with program files LDAPStoreHelper.\n\n\n\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"5decbc644b4f1955","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*"],"name":"bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on@1.81.1","type":"java-archive","version":"1.81.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk18on-1.81.1.jar","manifestName":"","pomArtifactID":"bcprov-jdk18on","archiveDigests":[{"value":"07bcb4c4664600c51190ab3774710a51bfdeb2eb","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bcprov-jdk18on-1.81.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c3fc-8qff-9hwx","versionConstraint":">=1.74,<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk18on","version":"1.81.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c3fc-8qff-9hwx","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-18","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0636","date":"2026-10-08","epss":0.00527,"percentile":0.42855}],"risk":0.276675,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-0636","https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c3fc-8qff-9hwx","description":"Bouncy Castle has an LDAP injection"},"relatedVulnerabilities":[{"id":"CVE-2026-0636","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0636","date":"2026-10-08","epss":0.00527,"percentile":0.42855}],"urls":["https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-0636","https://bugzilla.redhat.com/show_bug.cgi?id=2458641","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0636","description":"Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).\n\n This vulnerability is associated with program files LDAPStoreHelper.\n\n\n\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"903e769180d26980","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9586a7fe0e1775de0e54237fa6a2c8455c93ac06","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.19.0,<2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.21.6"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.21.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-08","epss":0.00529,"percentile":0.42947}],"risk":0.27243500000000004,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-08","epss":0.00529,"percentile":0.42947}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"be1505d07c389f4e","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"d82683120b05d1c9c56a88e1daff07e4c0420537","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5x3r-wrvg-rp6q","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5x3r-wrvg-rp6q","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47244","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-47244","date":"2026-10-08","epss":0.00507,"percentile":0.41331}],"risk":0.26110500000000003,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-47244"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5x3r-wrvg-rp6q","description":"Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced"},"relatedVulnerabilities":[{"id":"CVE-2026-47244","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47244","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-47244","date":"2026-10-08","epss":0.00507,"percentile":0.41331}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47244","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"ce2e79b81950191a","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-handler-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"f79da6a81f4390ed067301235e29705a7f774c5b","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-handler-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.17.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c4c3-7fpv-j4q5","versionConstraint":">=4.2.0.Final,<=4.2.16.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c4c3-7fpv-j4q5","fix":{"state":"fixed","versions":["4.2.17.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.2.17.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-08","epss":0.00277,"percentile":0.18503}],"risk":0.250685,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5","https://nvd.nist.gov/vuln/detail/CVE-2026-75595","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c4c3-7fpv-j4q5","description":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"},"relatedVulnerabilities":[{"id":"CVE-2026-75595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-08","epss":0.00277,"percentile":0.18503}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75595","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gcjf-9mgh-3p7g","versionConstraint":">=4.2.0.Final,<4.2.16.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gcjf-9mgh-3p7g","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-08","epss":0.00465,"percentile":0.38296}],"risk":0.248775,"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gcjf-9mgh-3p7g","description":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"},"relatedVulnerabilities":[{"id":"CVE-2026-59921","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-08","epss":0.00465,"percentile":0.38296}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59921","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4mp9-239f-g9hg","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4mp9-239f-g9hg","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-08","epss":0.00439,"percentile":0.36145}],"risk":0.24803499999999998,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4mp9-239f-g9hg","description":"Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation"},"relatedVulnerabilities":[{"id":"CVE-2026-59898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-08","epss":0.00439,"percentile":0.36145}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59898","description":"Netty is an asynchronous, event-driven network application framework.  Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"903e769180d26980","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9586a7fe0e1775de0e54237fa6a2c8455c93ac06","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pjw-73gf-8qr5","versionConstraint":">=2.19.0,<2.21.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pjw-73gf-8qr5","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59888","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59888","date":"2026-10-08","epss":0.00423,"percentile":0.34624}],"risk":0.243225,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5","https://nvd.nist.gov/vuln/detail/CVE-2026-59888","https://github.com/FasterXML/jackson-databind/pull/5974","https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4","https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pjw-73gf-8qr5","description":"jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy"},"relatedVulnerabilities":[{"id":"CVE-2026-59888","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59888","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59888","date":"2026-10-08","epss":0.00423,"percentile":0.34624}],"urls":["https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4","https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d","https://github.com/FasterXML/jackson-databind/pull/5974","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59888","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"3d10807f633e7ff7","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-core-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"5734323adfece72111769b0ae38a6cf803e3d178","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-core-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-72hv-8253-57qq","versionConstraint":">=2.19.0,<2.21.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-72hv-8253-57qq","fix":{"state":"fixed","versions":["2.21.1"],"available":[{"date":"2026-02-28","kind":"first-observed","version":"2.21.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18401","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-18401","date":"2026-10-08","epss":0.00408,"percentile":0.32972}],"risk":0.24276000000000003,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq","https://github.com/FasterXML/jackson-core/pull/1555","https://github.com/FasterXML/jackson-core/commit/b0c428e6f993e1b5ece5c1c3cb2523e887cd52cf","https://nvd.nist.gov/vuln/detail/CVE-2026-18401"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-72hv-8253-57qq","description":"jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition"},"relatedVulnerabilities":[{"id":"CVE-2026-18401","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18401","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-18401","date":"2026-10-08","epss":0.00408,"percentile":0.32972}],"urls":["https://github.com/FasterXML/jackson-core/commit/b0c428e6f993e1b5ece5c1c3cb2523e887cd52cf","https://github.com/FasterXML/jackson-core/pull/1555","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18401","description":"The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service.\n\n\n\nThe synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on which parsing API the application uses.\n\n\n\nRoot cause: the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods. Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never enforced on the async code path.\n\n\n\nImpact: an attacker sending a JSON document containing an arbitrarily long number to an application using the async parser (for example a Spring WebFlux or other reactive application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in O(n^2) BigInteger parsing, causing CPU-based denial of service.\n\n\n\nNo privileges or user interaction beyond the ability to submit data for parsing are required.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x.\n\n\n\nVersions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0."}]},{"artifact":{"id":"ba127fa905fad417","cpes":["cpe:2.3:a:io.netty.resolver-dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-resolver-dns","purl":"pkg:maven/io.netty/netty-resolver-dns@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-resolver-dns-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-resolver-dns","archiveDigests":[{"value":"565e7ff1266db445b6b1621b2f68015bf20b5406","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-resolver-dns-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xmv7-r254-6q78","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-resolver-dns","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xmv7-r254-6q78","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45673","cwe":"CWE-330","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45673","cwe":"CWE-340","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45673","date":"2026-10-08","epss":0.00403,"percentile":0.32419}],"risk":0.23776999999999995,"urls":["https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45673"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xmv7-r254-6q78","description":"Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port"},"relatedVulnerabilities":[{"id":"CVE-2026-45673","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45673","cwe":"CWE-330","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45673","cwe":"CWE-340","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45673","date":"2026-10-08","epss":0.00403,"percentile":0.32419}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45673","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"640a0ea1e3caeec6","cpes":["cpe:2.3:a:org.springframework:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring_expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring_expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_expression:6.2.11:*:*:*:*:*:*:*"],"name":"spring-expression","purl":"pkg:maven/org.springframework/spring-expression@6.2.11","type":"java-archive","version":"6.2.11","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-expression-6.2.11.jar","manifestName":"","pomArtifactID":"spring-expression","archiveDigests":[{"value":"7190c1c69576516efef1a061d956dccf17cb0b86","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-expression-6.2.11.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wxpp-56q6-5pcg","versionConstraint":">=6.2.0,<=6.2.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-expression","version":"6.2.11"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wxpp-56q6-5pcg","fix":{"state":"fixed","versions":["6.2.19"],"available":[{"date":"2026-07-30","kind":"first-observed","version":"6.2.19"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41851","cwe":"CWE-770","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41851","date":"2026-10-08","epss":0.0046,"percentile":0.37877}],"risk":0.2369,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41851","https://spring.io/security/cve-2026-41851","https://github.com/spring-projects/spring-framework/commit/2c18c33ce0f89bf718c184190cfb7ed49b4276fb","https://github.com/spring-projects/spring-framework/commit/76a36dfd707cddbe7118a81c2e055b36501d2cff","https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19","https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wxpp-56q6-5pcg","description":"Spring Framework Denial of Service via Unbounded Cache in SpEL"},"relatedVulnerabilities":[{"id":"CVE-2026-41851","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41851","cwe":"CWE-770","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41851","date":"2026-10-08","epss":0.0046,"percentile":0.37877}],"urls":["https://spring.io/security/cve-2026-41851"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41851","description":"Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48."}]},{"artifact":{"id":"be1505d07c389f4e","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"d82683120b05d1c9c56a88e1daff07e4c0420537","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c69g-56f8-xwqj","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c69g-56f8-xwqj","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59900","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59900","date":"2026-10-08","epss":0.00398,"percentile":0.31911}],"risk":0.23680999999999996,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c69g-56f8-xwqj","description":"Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-59900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59900","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59900","date":"2026-10-08","epss":0.00398,"percentile":0.31911}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59900","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"ba127fa905fad417","cpes":["cpe:2.3:a:io.netty.resolver-dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:resolver-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:resolver_dns:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-resolver-dns","purl":"pkg:maven/io.netty/netty-resolver-dns@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-resolver-dns-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-resolver-dns","archiveDigests":[{"value":"565e7ff1266db445b6b1621b2f68015bf20b5406","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-resolver-dns-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-676x-f7gg-47vc","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-resolver-dns","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-676x-f7gg-47vc","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45674","cwe":"CWE-345","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45674","cwe":"CWE-346","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45674","date":"2026-10-08","epss":0.00292,"percentile":0.19943}],"risk":0.23651999999999995,"urls":["https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45674","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-45674","https://bugzilla.redhat.com/show_bug.cgi?id=2488400","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.json","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-676x-f7gg-47vc","description":"Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records"},"relatedVulnerabilities":[{"id":"CVE-2026-45674","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":10,"impactScore":5.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45674","cwe":"CWE-345","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45674","cwe":"CWE-346","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45674","date":"2026-10-08","epss":0.00292,"percentile":0.19943}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/security/cve/CVE-2026-45674","https://bugzilla.redhat.com/show_bug.cgi?id=2488400","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45674","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cqp-g7gg-8hr5","versionConstraint":">=4.2.0.Final,<4.2.16.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cqp-g7gg-8hr5","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-08","epss":0.00408,"percentile":0.32984}],"risk":0.2346,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5","https://nvd.nist.gov/vuln/detail/CVE-2026-56746","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cqp-g7gg-8hr5","description":"Netty: Security Control Bypass via CORS Short-Circuit Failure"},"relatedVulnerabilities":[{"id":"CVE-2026-56746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-08","epss":0.00408,"percentile":0.32984}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56746","description":"Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"903e769180d26980","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9586a7fe0e1775de0e54237fa6a2c8455c93ac06","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.19.0,<2.21.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.21.5"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.21.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-08","epss":0.00443,"percentile":0.36467}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-08","epss":0.00443,"percentile":0.36467}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"ce2e79b81950191a","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-handler-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"f79da6a81f4390ed067301235e29705a7f774c5b","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-handler-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.17.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fccg-mwvh-qqg4","versionConstraint":">=4.2.0.Final,<=4.2.16.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fccg-mwvh-qqg4","fix":{"state":"fixed","versions":["4.2.17.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.2.17.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-08","epss":0.00374,"percentile":0.2925}],"risk":0.22253,"urls":["https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4","https://nvd.nist.gov/vuln/detail/CVE-2026-75596","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fccg-mwvh-qqg4","description":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-75596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-08","epss":0.00374,"percentile":0.2925}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75596","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75803","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-75803","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-08","epss":0.00232,"percentile":0.12871}],"risk":0.20996,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-75803"},"relatedVulnerabilities":[{"id":"CVE-2026-75803","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-08","epss":0.00232,"percentile":0.12871}],"urls":["https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803","description":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module."}]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75803","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-75803","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-08","epss":0.00232,"percentile":0.12871}],"risk":0.20996,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-75803"},"relatedVulnerabilities":[{"id":"CVE-2026-75803","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-08","epss":0.00232,"percentile":0.12871}],"urls":["https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803","description":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module."}]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-75803","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"3.5.8-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75803","versionConstraint":"< 3.5.8-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-75803","fix":{"state":"fixed","versions":["3.5.8-r0"],"available":[{"date":"2026-08-26","kind":"first-observed","version":"3.5.8-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-08","epss":0.00232,"percentile":0.12871}],"risk":0.20996,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-75803"},"relatedVulnerabilities":[{"id":"CVE-2026-75803","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-08","epss":0.00232,"percentile":0.12871}],"urls":["https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803","description":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m4cv-j2px-7723","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-m4cv-j2px-7723","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42580","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42580","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42580","date":"2026-10-08","epss":0.00362,"percentile":0.27988}],"risk":0.20815,"urls":["https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723","https://nvd.nist.gov/vuln/detail/CVE-2026-42580"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m4cv-j2px-7723","description":"Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-42580","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42580","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42580","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42580","date":"2026-10-08","epss":0.00362,"percentile":0.27988}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42580","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"f97e1fe8860ab5fc","cpes":["cpe:2.3:a:apache:shiro-spring:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro_spring:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:spring:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro:1.13.0:*:*:*:*:*:*:*"],"name":"shiro-spring","purl":"pkg:maven/org.apache.shiro/shiro-spring@1.13.0","type":"java-archive","version":"1.13.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.shiro","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/shiro-spring-1.13.0.jar","manifestName":"","pomArtifactID":"shiro-spring","archiveDigests":[{"value":"e9fc4c29045a67cf985ec9f0da3eac651f153624","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/shiro-spring-1.13.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c244-p6m5-vqj6","versionConstraint":"<=2.0.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.shiro:shiro-spring","version":"1.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c244-p6m5-vqj6","fix":{"state":"fixed","versions":["2.1.0"],"available":[{"date":"2026-03-04","kind":"first-observed","version":"2.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23903","cwe":"CWE-289","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-23903","date":"2026-10-08","epss":0.00402,"percentile":0.32369}],"risk":0.20703000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-23903","https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k","http://www.openwall.com/lists/oss-security/2026/02/08/1","https://github.com/apache/shiro/commit/3b9638b957495004599aeaf24ba8949e309f26e8"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c244-p6m5-vqj6","description":"Apache Shiro has an Authentication Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-23903","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23903","cwe":"CWE-289","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-23903","date":"2026-10-08","epss":0.00402,"percentile":0.32369}],"urls":["https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k","http://www.openwall.com/lists/oss-security/2026/02/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23903","description":"Authentication Bypass by Alternate Name vulnerability in Apache Shiro.\n\nThis issue affects Apache Shiro: before 2.0.7.\n\nUsers are recommended to upgrade to version 2.0.7, which fixes the issue.\n\nThe issue only effects static files. If static files are served from a case-insensitive filesystem,\nsuch as default macOS setup, static files may be accessed by varying the case of the filename in the request.\nIf only lower-case (common default) filters are present in Shiro, they may be bypassed this way.\n\nShiro 2.1.0 and later has a new parameters to remediate this issue\nshiro.ini: filterChainResolver.caseInsensitive = true\napplication.properties: shiro.caseInsensitive=true\n\nShiro 3.0.0 and later makes this the default in shiro.ini-based configurations.\nShiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot."}]},{"artifact":{"id":"db0be20435ff9026","cpes":["cpe:2.3:a:gnu:tar:1.35-r5:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:1.35-r5:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:apk/alpine/tar@1.35-r5?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"1.35-r5","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/tar"},{"path":"/usr"},{"path":"/usr/libexec"},{"path":"/usr/libexec/rmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tar"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-5704","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*"],"package":{"name":"tar","version":"1.35-r5"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-5704","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-10-08","epss":0.00401,"percentile":0.32244}],"risk":0.20551249999999996,"urls":["https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:66514","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-5704","https://bugzilla.redhat.com/show_bug.cgi?id=2455360","http://www.openwall.com/lists/oss-security/2026/04/11/10","http://www.openwall.com/lists/oss-security/2026/04/11/11","http://www.openwall.com/lists/oss-security/2026/04/12/2"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."},"relatedVulnerabilities":[]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hvcg-qmg6-jm4c","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hvcg-qmg6-jm4c","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50020","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50020","date":"2026-10-08","epss":0.00398,"percentile":0.3191}],"risk":0.20497,"urls":["https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c","https://nvd.nist.gov/vuln/detail/CVE-2026-50020","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hvcg-qmg6-jm4c","description":"Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted"},"relatedVulnerabilities":[{"id":"CVE-2026-50020","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50020","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50020","date":"2026-10-08","epss":0.00398,"percentile":0.3191}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50020","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00–0x1F and 0x7F) as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance intended to handle HTTP/1.0 POST workarounds. Silently absorbing NUL bytes, SOH, STX, and other non-CRLF control characters goes significantly beyond this, and can be exploited for request-boundary confusion in pipelined or multiplexed transports where a front-end component treats those bytes differently. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"44bc47f6eab197e1","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-98j2-6v39-78w8","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-98j2-6v39-78w8","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13505","cwe":"CWE-772","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13505","date":"2026-10-08","epss":0.00253,"percentile":0.15421}],"risk":0.20493,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13505","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-98j2-6v39-78w8","description":"Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization."},"relatedVulnerabilities":[{"id":"CVE-2026-13505","cvss":[{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13505","cwe":"CWE-772","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13505","date":"2026-10-08","epss":0.00253,"percentile":0.15421}],"urls":["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13505","description":"In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by overriding Object.finalize. Finalization runs at an unspecified time and in an unspecified order and is serviced by a single finalizer thread, so where objects carrying a finalizer are allocated faster than that thread retires them the pending-finalization queue grows without bound: disposal falls arbitrarily far behind, which can contribute to an OutOfMemoryError under load, and the key material those objects hold stays resident in the heap for as long as they are queued, defeating the purpose of the zeroisation. The behaviour was not a problem on Java 8 or Java 11; it is later JVMs, on which finalization has been deprecated and progressively de-emphasised, where it becomes one. Disposal of these classes now runs from a java.lang.ref.Cleaner registered in the multi-release jdk1.9 overlay, so on Java 9 and later it no longer depends on the finalizer being scheduled. Bouncy Castle for Java (bcprov) and Bouncy Castle for Java LTS are not affected, as neither implements the finalizer-based zeroisation scheme."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-72897","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-72897","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-08","epss":0.00266,"percentile":0.1695}],"risk":0.1995,"urls":["https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922","https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e","https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61","https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-72897","description":"Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\nconnection to a different SSL_CTX part way through a handshake may access\nmemory beyond the end of an internal array if the replacement context knows\nabout more provider signature algorithms than the context the connection was\ncreated from. Applications which never call SSL_set_SSL_CTX() are not\naffected.\n\nImpact summary: A remote peer may be able to cause a small out-of-bounds\nread, and in some circumstances a fixed-value out-of-bounds write, on the\nserver heap. This may lead to a Denial of Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: A TLS connection records how many certificate slots it has\nwhen it is created, taken from the SSL_CTX that created it: the built-in\ncertificate types plus one slot for each provider TLS-SIGALG entry that\ncontext was aware of. That count sizes an internal array of per-slot\ncertificate validity flags.\n\nAn application may replace a connection's SSL_CTX part way through the\nhandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\ncallback in order to serve a different virtual host. Doing so did not\nrefresh the recorded count. A provider signature algorithm's slot index is\nits position in the list of whichever context resolves it, so if the\nreplacement context is aware of more of them than the original, an\nalgorithm offered by the peer can resolve to an index beyond the end of the\narray. Processing the peer's signature algorithms then reads one four byte\nword past the end for each such algorithm and, where the word read is zero,\nwrites a fixed value over it. A peer offering many of them can corrupt heap\nmetadata and abort the process.\n\nOnly provider signature algorithms which occupy one of the excess slots,\nand which the server also has configured, have this effect. Codepoints the\nreplacement context does not recognise are discarded without being resolved\nto a slot, and provider signature algorithms are usable only from TLS 1.3.\n\nThe two contexts must therefore be aware of different numbers of provider\nsignature algorithms, which requires separate library contexts, a provider\nloaded between the two being created, or providers which differ in what\nthey advertise - in 4.0, for example, the default provider advertises SM2\nwhere the FIPS provider does not. A deployment meeting the condition is\nalso unable to negotiate the affected algorithms with legitimate clients,\nsince the same stale count hides the corresponding certificates, so the\nmisconfiguration is likely to be noticed. For that reason, and because the\nconfiguration is not the default, this issue has been assessed as Low\nseverity.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-72897","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-72897","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-08","epss":0.00266,"percentile":0.1695}],"risk":0.1995,"urls":["https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922","https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e","https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61","https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-72897","description":"Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\nconnection to a different SSL_CTX part way through a handshake may access\nmemory beyond the end of an internal array if the replacement context knows\nabout more provider signature algorithms than the context the connection was\ncreated from. Applications which never call SSL_set_SSL_CTX() are not\naffected.\n\nImpact summary: A remote peer may be able to cause a small out-of-bounds\nread, and in some circumstances a fixed-value out-of-bounds write, on the\nserver heap. This may lead to a Denial of Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: A TLS connection records how many certificate slots it has\nwhen it is created, taken from the SSL_CTX that created it: the built-in\ncertificate types plus one slot for each provider TLS-SIGALG entry that\ncontext was aware of. That count sizes an internal array of per-slot\ncertificate validity flags.\n\nAn application may replace a connection's SSL_CTX part way through the\nhandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\ncallback in order to serve a different virtual host. Doing so did not\nrefresh the recorded count. A provider signature algorithm's slot index is\nits position in the list of whichever context resolves it, so if the\nreplacement context is aware of more of them than the original, an\nalgorithm offered by the peer can resolve to an index beyond the end of the\narray. Processing the peer's signature algorithms then reads one four byte\nword past the end for each such algorithm and, where the word read is zero,\nwrites a fixed value over it. A peer offering many of them can corrupt heap\nmetadata and abort the process.\n\nOnly provider signature algorithms which occupy one of the excess slots,\nand which the server also has configured, have this effect. Codepoints the\nreplacement context does not recognise are discarded without being resolved\nto a slot, and provider signature algorithms are usable only from TLS 1.3.\n\nThe two contexts must therefore be aware of different numbers of provider\nsignature algorithms, which requires separate library contexts, a provider\nloaded between the two being created, or providers which differ in what\nthey advertise - in 4.0, for example, the default provider advertises SM2\nwhere the FIPS provider does not. A deployment meeting the condition is\nalso unable to negotiate the affected algorithms with legitimate clients,\nsince the same stale count hides the corresponding certificates, so the\nmisconfiguration is likely to be noticed. For that reason, and because the\nconfiguration is not the default, this issue has been assessed as Low\nseverity.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-72897","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-72897","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72897","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-72897","date":"2026-10-08","epss":0.00266,"percentile":0.1695}],"risk":0.1995,"urls":["https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922","https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e","https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61","https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-72897","description":"Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\nconnection to a different SSL_CTX part way through a handshake may access\nmemory beyond the end of an internal array if the replacement context knows\nabout more provider signature algorithms than the context the connection was\ncreated from. Applications which never call SSL_set_SSL_CTX() are not\naffected.\n\nImpact summary: A remote peer may be able to cause a small out-of-bounds\nread, and in some circumstances a fixed-value out-of-bounds write, on the\nserver heap. This may lead to a Denial of Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: A TLS connection records how many certificate slots it has\nwhen it is created, taken from the SSL_CTX that created it: the built-in\ncertificate types plus one slot for each provider TLS-SIGALG entry that\ncontext was aware of. That count sizes an internal array of per-slot\ncertificate validity flags.\n\nAn application may replace a connection's SSL_CTX part way through the\nhandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\ncallback in order to serve a different virtual host. Doing so did not\nrefresh the recorded count. A provider signature algorithm's slot index is\nits position in the list of whichever context resolves it, so if the\nreplacement context is aware of more of them than the original, an\nalgorithm offered by the peer can resolve to an index beyond the end of the\narray. Processing the peer's signature algorithms then reads one four byte\nword past the end for each such algorithm and, where the word read is zero,\nwrites a fixed value over it. A peer offering many of them can corrupt heap\nmetadata and abort the process.\n\nOnly provider signature algorithms which occupy one of the excess slots,\nand which the server also has configured, have this effect. Codepoints the\nreplacement context does not recognise are discarded without being resolved\nto a slot, and provider signature algorithms are usable only from TLS 1.3.\n\nThe two contexts must therefore be aware of different numbers of provider\nsignature algorithms, which requires separate library contexts, a provider\nloaded between the two being created, or providers which differ in what\nthey advertise - in 4.0, for example, the default provider advertises SM2\nwhere the FIPS provider does not. A deployment meeting the condition is\nalso unable to negotiate the affected algorithms with legitimate clients,\nsince the same stale count hides the corresponding certificates, so the\nmisconfiguration is likely to be noticed. For that reason, and because the\nconfiguration is not the default, this issue has been assessed as Low\nseverity.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-75806","versionConstraint":">= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-08","epss":0.00387,"percentile":0.30642}],"risk":0.199305,"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-75806","versionConstraint":">= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-08","epss":0.00387,"percentile":0.30642}],"risk":0.199305,"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-75806","versionConstraint":">= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-08","epss":0.00387,"percentile":0.30642}],"risk":0.199305,"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"2e058fb271e28b3d","cpes":["cpe:2.3:a:io.netty.codec-dns:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-dns:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-dns:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-dns:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-dns:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_dns:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-dns","purl":"pkg:maven/io.netty/netty-codec-dns@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-dns-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-dns","archiveDigests":[{"value":"94e72675257d9dffa405f0e989de6acda962fed1","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-dns-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mfg7-5gfp-c4w3","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-dns","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mfg7-5gfp-c4w3","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-25","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73508","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-73508","date":"2026-10-08","epss":0.00382,"percentile":0.30064}],"risk":0.19673,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3","https://github.com/netty/netty/pull/17063","https://github.com/netty/netty/pull/17065","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mfg7-5gfp-c4w3","description":"Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names"},"relatedVulnerabilities":[{"id":"CVE-2026-73508","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73508","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-73508","date":"2026-10-08","epss":0.00382,"percentile":0.30064}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73508","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"d915eaa34f2bddf6","cpes":["cpe:2.3:a:spring-security-saml2-service-provider:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service-provider:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service-provider:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.6:*:*:*:*:*:*:*"],"name":"spring-security-saml2-service-provider","purl":"pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.6","type":"java-archive","version":"6.5.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-saml2-service-provider-6.5.6.jar","manifestName":"","pomArtifactID":"spring-security-saml2-service-provider","archiveDigests":[{"value":"c1db9cba3dac366d16162dc7a71f3a42146bbd8d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-saml2-service-provider-6.5.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pjj-qpw6-5fcm","versionConstraint":">=6.5.0,<=6.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-saml2-service-provider","version":"6.5.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pjj-qpw6-5fcm","fix":{"state":"fixed","versions":["6.5.11"],"available":[{"date":"2026-08-13","kind":"first-observed","version":"6.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41003","cwe":"CWE-79","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41003","date":"2026-10-08","epss":0.00253,"percentile":0.15468}],"risk":0.19101500000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41003","https://spring.io/security/cve-2026-41003","https://github.com/spring-projects/spring-security/releases/tag/6.5.11","https://github.com/spring-projects/spring-security/releases/tag/7.0.6"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pjj-qpw6-5fcm","description":"Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters"},"relatedVulnerabilities":[{"id":"CVE-2026-41003","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41003","cwe":"CWE-79","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41003","date":"2026-10-08","epss":0.00253,"percentile":0.15468}],"urls":["https://spring.io/security/cve-2026-41003"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41003","description":"An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.\n\nAffected versions:\nSpring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5."}]},{"artifact":{"id":"903e769180d26980","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9586a7fe0e1775de0e54237fa6a2c8455c93ac06","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hgj6-7826-r7m5","versionConstraint":">=2.19.0,<2.21.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hgj6-7826-r7m5","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54514","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54514","date":"2026-10-08","epss":0.00368,"percentile":0.2857}],"risk":0.18952000000000002,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5","https://github.com/FasterXML/jackson-databind/pull/5951","https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","https://nvd.nist.gov/vuln/detail/CVE-2026-54514"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hgj6-7826-r7m5","description":"jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)"},"relatedVulnerabilities":[{"id":"CVE-2026-54514","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54514","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54514","date":"2026-10-08","epss":0.00368,"percentile":0.2857}],"urls":["https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","https://github.com/FasterXML/jackson-databind/pull/5951","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54514","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"d4ab3efc304a4e30","cpes":["cpe:2.3:a:openjdk21:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk21:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*"],"name":"openjdk21","purl":"pkg:apk/alpine/openjdk21@21.0.12_p8-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"21.0.12_p8-r0","language":"","licenses":["GPL-2.0-with-classpath-exception"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/jvm"},{"path":"/usr/lib/jvm/java-21-openjdk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openjdk21"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-61308","versionConstraint":"< 1.8.0_504||>= 1.9, < 8.0.504||>= 12, < 17.0.20.1||>= 18, < 21.0.12.1||>= 22, < 25.0.4.1||>= 26, < 26.0.2.1||>= 9, < 11.0.32.1 (jvm)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.12_p8:*:*:*:*:*:*:*"],"package":{"name":"openjdk21","version":"21.0.12_p8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-61308","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61308","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61308","date":"2026-10-08","epss":0.0031,"percentile":0.21851}],"risk":0.18289999999999998,"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61308","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-75804","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-75804","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-08","epss":0.00352,"percentile":0.26759}],"risk":0.18128,"urls":["https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e","https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538","https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a","https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-75804","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-75804","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-08","epss":0.00352,"percentile":0.26759}],"risk":0.18128,"urls":["https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e","https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538","https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a","https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-75804","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-75804","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-10-08","epss":0.00352,"percentile":0.26759}],"risk":0.18128,"urls":["https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e","https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538","https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a","https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"b094921a681aed1c","cpes":["cpe:2.3:a:apache:shiro-web:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro_web:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:web:1.13.0:*:*:*:*:*:*:*"],"name":"shiro-web","purl":"pkg:maven/org.apache.shiro/shiro-web@1.13.0","type":"java-archive","version":"1.13.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.shiro","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/shiro-web-1.13.0.jar","manifestName":"","pomArtifactID":"shiro-web","archiveDigests":[{"value":"99a09dc19f37487639b5bab978953bc38963d6ea","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/shiro-web-1.13.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c6r4-qjmw-cvj2","versionConstraint":">=1.0.0-incubating,<2.2.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.shiro:shiro-web","version":"1.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c6r4-qjmw-cvj2","fix":{"state":"fixed","versions":["2.2.0"],"available":[{"date":"2026-07-01","kind":"first-observed","version":"2.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/RE:L/U:Amber","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43828","cwe":"CWE-614","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-43828","date":"2026-10-08","epss":0.00331,"percentile":0.24262}],"risk":0.180395,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-43828","https://shiro.apache.org/security-reports.html#cve_2026_43828","http://www.openwall.com/lists/oss-security/2026/05/25/7"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c6r4-qjmw-cvj2","description":"Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute"},"relatedVulnerabilities":[{"id":"CVE-2026-43828","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43828","cwe":"CWE-614","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-43828","date":"2026-10-08","epss":0.00331,"percentile":0.24262}],"urls":["https://shiro.apache.org/security-reports.html#cve_2026_43828","http://www.openwall.com/lists/oss-security/2026/05/25/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-43828","description":"Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.\n\n\n\nThis issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.\n\nUsers are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.\n\nIn the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default."}]},{"artifact":{"id":"4395698d712dd597","cpes":["cpe:2.3:a:nghttp2-libs:nghttp2-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp2_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp_libs:1.69.0-r0:*:*:*:*:*:*:*"],"name":"nghttp2-libs","purl":"pkg:apk/alpine/nghttp2-libs@1.69.0-r0?arch=x86_64&distro=alpine-3.24.1&upstream=nghttp2","type":"apk","version":"1.69.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libnghttp2.so.14"},{"path":"/usr/lib/libnghttp2.so.14.29.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nghttp2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.70.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58055","versionConstraint":"< 1.70.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"nghttp2","version":"1.69.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-58055","fix":{"state":"fixed","versions":["1.70.0-r0"],"available":[{"date":"2026-10-02","kind":"first-observed","version":"1.70.0-r0"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58055","cwe":"CWE-444","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58055","date":"2026-10-08","epss":0.00319,"percentile":0.22818}],"risk":0.18023499999999998,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-58055"},"relatedVulnerabilities":[{"id":"CVE-2026-58055","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58055","cwe":"CWE-444","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58055","date":"2026-10-08","epss":0.00319,"percentile":0.22818}],"urls":["https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc","https://github.com/nghttp2/nghttp2/commit/ab28105c4a0197da24f8bfc414bc116055249e1e","https://www.vulncheck.com/advisories/nghttp2-nghttpx-http-request-response-smuggling-via-upgrade-request-with-content-length"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58055","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning."}]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v8h7-rr48-vmmv","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v8h7-rr48-vmmv","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-06","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41417","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41417","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41417","date":"2026-10-08","epss":0.00336,"percentile":0.2491}],"risk":0.17304000000000003,"urls":["https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv","https://nvd.nist.gov/vuln/detail/CVE-2026-41417"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v8h7-rr48-vmmv","description":"Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection"},"relatedVulnerabilities":[{"id":"CVE-2026-41417","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41417","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41417","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41417","date":"2026-10-08","epss":0.00336,"percentile":0.2491}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41417","description":"Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"f849d723397cdd1c","cpes":["cpe:2.3:a:org.eclipse.jetty.util:jetty-util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.util:jetty_util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty-util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty_util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty-util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty_util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.util:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty-util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.util:util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-util:jetty-util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-util:jetty_util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_util:jetty-util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_util:jetty_util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-util:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_util:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-util:util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_util:util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:util:jetty-util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:util:jetty_util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:util:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:util:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:util:util:12.0.17:*:*:*:*:*:*:*"],"name":"jetty-util","purl":"pkg:maven/org.eclipse.jetty/jetty-util@12.0.17","type":"java-archive","version":"12.0.17","language":"java","licenses":["https://www.eclipse.org/legal/epl-2.0/, https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jetty-util-12.0.17.jar","manifestName":"","pomArtifactID":"jetty-util","archiveDigests":[{"value":"f3c503a597def913e572f167f32e30b9a067022f","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jetty-util-12.0.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"12.0.35"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w7x5-g22v-xqhr","versionConstraint":">=12.0.0,<=12.0.34 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-util","version":"12.0.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w7x5-g22v-xqhr","fix":{"state":"fixed","versions":["12.0.35"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"12.0.35"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8384","cwe":"CWE-647","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-8384","date":"2026-10-08","epss":0.0033,"percentile":0.24107}],"risk":0.16995000000000002,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-w7x5-g22v-xqhr","https://nvd.nist.gov/vuln/detail/CVE-2026-8384","https://github.com/jetty/jetty.project/pull/14969","https://github.com/jetty/jetty.project/pull/14973","https://github.com/jetty/jetty.project/commit/82969c77f6da46e27008b10b3c14840cd31db084","https://github.com/jetty/jetty.project/commit/ade27ce93a37c33278720250d85c48601230ae3f","https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.35","https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.9","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w7x5-g22v-xqhr","description":"Eclipse Jetty: Path parameter traversal"},"relatedVulnerabilities":[{"id":"CVE-2026-8384","cvss":[{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8384","cwe":"CWE-647","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-8384","date":"2026-10-08","epss":0.0033,"percentile":0.24107}],"urls":["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8384","description":"In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-42772","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-42772","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-08","epss":0.0033,"percentile":0.24031}],"risk":0.16995000000000002,"urls":["https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09","https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e","https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773","https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42772","description":"Issue summary: The QUIC stream reassembly algorithm performance deteriorates\nprogressively as packets are arriving out of order. The worst case has\na quadratic complexity proportional to the number of stream frames kept in\nthe buffer for the received stream data.\n\nImpact summary: A remote QUIC peer that completes the handshake can create\na connection-scoped CPU pressure and potentially a Denial of Service using\ncompliant STREAM frames inside the advertised receive window, with low\nattacker bandwidth.\n\nCWE: CWE-407: Inefficient Algorithmic Complexity\n\nDescription: OpenSSL manages received QUIC stream fragments using a\ndoubly-linked list. While it optimizes for append operations (at the end of\nthe list), it falls back to a head-to-tail linear search for any fragment\nthat does not immediately follow the current `tail`.\n\nBy manipulating the sequence of offsets, an attacker can force the server\nto perform O(n^2) operations, consuming excessive CPU time for the\nQUIC process.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-42772","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-42772","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-08","epss":0.0033,"percentile":0.24031}],"risk":0.16995000000000002,"urls":["https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09","https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e","https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773","https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42772","description":"Issue summary: The QUIC stream reassembly algorithm performance deteriorates\nprogressively as packets are arriving out of order. The worst case has\na quadratic complexity proportional to the number of stream frames kept in\nthe buffer for the received stream data.\n\nImpact summary: A remote QUIC peer that completes the handshake can create\na connection-scoped CPU pressure and potentially a Denial of Service using\ncompliant STREAM frames inside the advertised receive window, with low\nattacker bandwidth.\n\nCWE: CWE-407: Inefficient Algorithmic Complexity\n\nDescription: OpenSSL manages received QUIC stream fragments using a\ndoubly-linked list. While it optimizes for append operations (at the end of\nthe list), it falls back to a head-to-tail linear search for any fragment\nthat does not immediately follow the current `tail`.\n\nBy manipulating the sequence of offsets, an attacker can force the server\nto perform O(n^2) operations, consuming excessive CPU time for the\nQUIC process.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-42772","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-42772","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42772","cwe":"CWE-407","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42772","date":"2026-10-08","epss":0.0033,"percentile":0.24031}],"risk":0.16995000000000002,"urls":["https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09","https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e","https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773","https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42772","description":"Issue summary: The QUIC stream reassembly algorithm performance deteriorates\nprogressively as packets are arriving out of order. The worst case has\na quadratic complexity proportional to the number of stream frames kept in\nthe buffer for the received stream data.\n\nImpact summary: A remote QUIC peer that completes the handshake can create\na connection-scoped CPU pressure and potentially a Denial of Service using\ncompliant STREAM frames inside the advertised receive window, with low\nattacker bandwidth.\n\nCWE: CWE-407: Inefficient Algorithmic Complexity\n\nDescription: OpenSSL manages received QUIC stream fragments using a\ndoubly-linked list. While it optimizes for append operations (at the end of\nthe list), it falls back to a head-to-tail linear search for any fragment\nthat does not immediately follow the current `tail`.\n\nBy manipulating the sequence of offsets, an attacker can force the server\nto perform O(n^2) operations, consuming excessive CPU time for the\nQUIC process.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-38f8-5428-x5cv","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-38f8-5428-x5cv","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42585","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42585","date":"2026-10-08","epss":0.00293,"percentile":0.20036}],"risk":0.16847499999999999,"urls":["https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv","https://datatracker.ietf.org/doc/html/rfc9112#name-message-body-length","https://nvd.nist.gov/vuln/detail/CVE-2026-42585"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-38f8-5428-x5cv","description":"Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding"},"relatedVulnerabilities":[{"id":"CVE-2026-42585","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42585","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42585","date":"2026-10-08","epss":0.00293,"percentile":0.20036}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42585","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"fef07e9c95ea2bda","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"915155597fcdee9a","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.1&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8a9ef44e1018f213","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.1&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"f74a0a96746e4842","cpes":["cpe:2.3:a:org.springframework.security:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.6:*:*:*:*:*:*:*"],"name":"spring-security-web","purl":"pkg:maven/org.springframework.security/spring-security-web@6.5.6","type":"java-archive","version":"6.5.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-web-6.5.6.jar","manifestName":"","pomArtifactID":"spring-security-web","archiveDigests":[{"value":"7428000af55e700e10c0378cad694ed23fda59be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-web-6.5.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x2r2-rvhq-2mqv","versionConstraint":">=6.5.0,<=6.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-web","version":"6.5.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x2r2-rvhq-2mqv","fix":{"state":"fixed","versions":["6.5.11"],"available":[{"date":"2026-08-12","kind":"first-observed","version":"6.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41706","cwe":"CWE-601","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41706","date":"2026-10-08","epss":0.00297,"percentile":0.20473}],"risk":0.16483499999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41706","https://spring.io/security/cve-2026-41706","https://github.com/spring-projects/spring-security/releases/tag/6.5.11","https://github.com/spring-projects/spring-security/releases/tag/7.0.6"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x2r2-rvhq-2mqv","description":"Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache"},"relatedVulnerabilities":[{"id":"CVE-2026-41706","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41706","cwe":"CWE-601","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41706","date":"2026-10-08","epss":0.00297,"percentile":0.20473}],"urls":["https://spring.io/security/cve-2026-41706"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41706","description":"Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is used without validation as the post-login redirect target.\n\nAffected versions:\nSpring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5."}]},{"artifact":{"id":"903e769180d26980","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.20.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.20.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1","type":"java-archive","version":"2.20.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"9586a7fe0e1775de0e54237fa6a2c8455c93ac06","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jackson-databind-2.20.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.19.0,<2.21.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.20.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.21.5"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.21.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-08","epss":0.00313,"percentile":0.22169}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-08","epss":0.00313,"percentile":0.22169}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"976d7815b2e90949","cpes":["cpe:2.3:a:jonathan-hedley:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jonathan_hedley:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:org.jsoup:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jsoup:jsoup:1.15.3:*:*:*:*:*:*:*"],"name":"jsoup","purl":"pkg:maven/org.jsoup/jsoup@1.15.3","type":"java-archive","version":"1.15.3","language":"java","licenses":["https://jsoup.org/license"],"metadata":{"pomGroupID":"org.jsoup","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jsoup-1.15.3.jar","manifestName":"","pomArtifactID":"jsoup","archiveDigests":[{"value":"f6e1d8a8819f854b681c8eaa57fd59a42329e10c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jsoup-1.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pmhh-3w7g-xqp8","versionConstraint":">=1.14.3,<1.23.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jsoup:jsoup","version":"1.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pmhh-3w7g-xqp8","fix":{"state":"fixed","versions":["1.23.1"],"available":[{"date":"2026-08-07","kind":"first-observed","version":"1.23.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-71497","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-71497","date":"2026-10-08","epss":0.00296,"percentile":0.2037}],"risk":0.14356,"urls":["https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8","https://github.com/jhy/jsoup/issues/2538","https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pmhh-3w7g-xqp8","description":"jsoup: Cleaner may expose markup with custom raw-text elements"},"relatedVulnerabilities":[{"id":"CVE-2026-71497","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-71497","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-71497","date":"2026-10-08","epss":0.00296,"percentile":0.2037}],"urls":["https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","https://github.com/jhy/jsoup/issues/2538","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1","https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71497","description":"jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1."}]},{"artifact":{"id":"d4ab3efc304a4e30","cpes":["cpe:2.3:a:openjdk21:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk21:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*"],"name":"openjdk21","purl":"pkg:apk/alpine/openjdk21@21.0.12_p8-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"21.0.12_p8-r0","language":"","licenses":["GPL-2.0-with-classpath-exception"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/jvm"},{"path":"/usr/lib/jvm/java-21-openjdk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openjdk21"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70907","versionConstraint":"< 1.8.0_504||>= 1.9, < 8.0.504||>= 12, < 17.0.20.1||>= 18, < 21.0.12.1||>= 22, < 25.0.4.1||>= 26, < 26.0.2.1||>= 9, < 11.0.32.1 (jvm)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.12_p8:*:*:*:*:*:*:*"],"package":{"name":"openjdk21","version":"21.0.12_p8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70907","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70907","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-70907","date":"2026-10-08","epss":0.00278,"percentile":0.18549}],"risk":0.14317,"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70907","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"ac2f45c006e79ab8","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"20077d54b08a1cf7d764b169946373dff2e9f9be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-codec-http-4.2.9.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.17.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c42-7qj2-3j46","versionConstraint":">=4.2.0.Final,<=4.2.16.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8c42-7qj2-3j46","fix":{"state":"fixed","versions":["4.2.17.Final"],"available":[{"date":"2026-08-18","kind":"first-observed","version":"4.2.17.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-08","epss":0.00246,"percentile":0.1453}],"risk":0.14145,"urls":["https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c42-7qj2-3j46","description":"Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite"},"relatedVulnerabilities":[{"id":"CVE-2026-59903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-08","epss":0.00246,"percentile":0.1453}],"urls":["https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-35189","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-35189","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-10-08","epss":0.00267,"percentile":0.17282}],"risk":0.13750500000000002,"urls":["https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84","https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89","https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f","https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35189","description":"Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof several hundred MiB of resident memory on the receiving side\nduring a normal TLS handshake.  This may be enough to crash the client or\nserver, if multiple concurrent connections lead to similarly large memory\nallocations.\n\nThe fix postpones processing of the CRL distribution points extensions in\ncertificates to the time when the processed value is required for CRL processing.\nThis avoids keeping large memory allocations for a long time when such\ncertificates are received.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-35189","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-35189","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-10-08","epss":0.00267,"percentile":0.17282}],"risk":0.13750500000000002,"urls":["https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84","https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89","https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f","https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35189","description":"Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof several hundred MiB of resident memory on the receiving side\nduring a normal TLS handshake.  This may be enough to crash the client or\nserver, if multiple concurrent connections lead to similarly large memory\nallocations.\n\nThe fix postpones processing of the CRL distribution points extensions in\ncertificates to the time when the processed value is required for CRL processing.\nThis avoids keeping large memory allocations for a long time when such\ncertificates are received.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-35189","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-35189","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-10-08","epss":0.00267,"percentile":0.17282}],"risk":0.13750500000000002,"urls":["https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84","https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89","https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f","https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35189","description":"Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof several hundred MiB of resident memory on the receiving side\nduring a normal TLS handshake.  This may be enough to crash the client or\nserver, if multiple concurrent connections lead to similarly large memory\nallocations.\n\nThe fix postpones processing of the CRL distribution points extensions in\ncertificates to the time when the processed value is required for CRL processing.\nThis avoids keeping large memory allocations for a long time when such\ncertificates are received.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"21ec0735fd00187e","cpes":["cpe:2.3:a:springsource-spring-framework:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring-framework:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring-framework:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring-framework:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:vmware:springsource_spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springsource:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_framework:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring-core:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_core:6.2.11:*:*:*:*:*:*:*"],"name":"spring-core","purl":"pkg:maven/org.springframework/spring-core@6.2.11","type":"java-archive","version":"6.2.11","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-core-6.2.11.jar","manifestName":"","pomArtifactID":"spring-core","archiveDigests":[{"value":"0f4860eb6ea92abb8ae6c5e82e2e7efc395cef8d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-core-6.2.11.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-659m-px2c-25wj","versionConstraint":">=6.2.0,<=6.2.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-core","version":"6.2.11"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-659m-px2c-25wj","fix":{"state":"fixed","versions":["6.2.19"],"available":[{"date":"2026-07-31","kind":"first-observed","version":"6.2.19"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41848","cwe":"CWE-1333","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41848","date":"2026-10-08","epss":0.00405,"percentile":0.32654}],"risk":0.135675,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41848","https://spring.io/security/cve-2026-41848","https://github.com/spring-projects/spring-framework/commit/12b44f2545a1bec6150c7a05e66092c732597a94","https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19","https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-659m-px2c-25wj","description":"Spring Framework Denial of Service via AntPathMatcher"},"relatedVulnerabilities":[{"id":"CVE-2026-41848","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41848","cwe":"CWE-1333","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41848","date":"2026-10-08","epss":0.00405,"percentile":0.32654}],"urls":["https://spring.io/security/cve-2026-41848"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41848","description":"Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48."}]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56109","versionConstraint":"< 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56109","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56109","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56109","date":"2026-10-08","epss":0.00186,"percentile":0.07489}],"risk":0.13392,"urls":["https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0","https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1","https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56109","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read."},"relatedVulnerabilities":[]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-35191","versionConstraint":">= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-35191","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35191","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35191","date":"2026-10-08","epss":0.00357,"percentile":0.27407}],"risk":0.11959499999999999,"urls":["https://github.com/openssl/openssl/commit/0fe4442d4f8ea3af8a174046dae176e0d4717239","https://github.com/openssl/openssl/commit/2de4c35fb13fc58f43fd8dc1d261700472ce72e5","https://github.com/openssl/openssl/commit/e44292e58b090014232ef75bd400393851b24d1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35191","description":"Issue summary: The OpenSSL QUIC server, when configured to not preform address\nvalidation, can be forced to count incoming packets multiple times in its\nunvalidated credit computation, leading to a violation of the RFC 9000\nunvalidated connection amplification limit of 3 times the amount of data\nreceived.\n\nImpact summary: A remote attacker able to spoof packets to a server using the\nOpenSSL QUIC implementation might use the server for an amplification of\na DDoS attack.\n\nCWE: CWE-440: Expected Behavior Violation \n\nDescription: OpenSSL's QUIC stack, when operating as a server, enforces client\naddress validation (RFC 9000, Section 8), to confirm the peer address is not\nused for a traffic amplification attack.  If this feature is disabled on the\nserver, the QUIC stack limits the amount of server data that can be sent to 3\ntimes the amount of data received from the peer address, until such time as the\nTLS handshake is completed.\n\nThe OpenSSL QUIC server, when operating in non-validation mode, adds the\nlength of the whole datagram received to the unvalidated credit limit when\nprocessing each QUIC packet in the datagram. A remote peer may,\nafter establishing a connection with an initial client hello frame, send a\nsubsequent datagram containing multiple QUIC packets, leading the server to\naccount the entire datagram length for each packet in the datagram, resulting\nin the server believing that the peer has sent more data than it actually has,\nthereby violating the 3x amplification limit mandated by the RFC.\n\nFIPS impact: no\nAs the QUIC stack lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-35191","versionConstraint":">= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-35191","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35191","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35191","date":"2026-10-08","epss":0.00357,"percentile":0.27407}],"risk":0.11959499999999999,"urls":["https://github.com/openssl/openssl/commit/0fe4442d4f8ea3af8a174046dae176e0d4717239","https://github.com/openssl/openssl/commit/2de4c35fb13fc58f43fd8dc1d261700472ce72e5","https://github.com/openssl/openssl/commit/e44292e58b090014232ef75bd400393851b24d1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35191","description":"Issue summary: The OpenSSL QUIC server, when configured to not preform address\nvalidation, can be forced to count incoming packets multiple times in its\nunvalidated credit computation, leading to a violation of the RFC 9000\nunvalidated connection amplification limit of 3 times the amount of data\nreceived.\n\nImpact summary: A remote attacker able to spoof packets to a server using the\nOpenSSL QUIC implementation might use the server for an amplification of\na DDoS attack.\n\nCWE: CWE-440: Expected Behavior Violation \n\nDescription: OpenSSL's QUIC stack, when operating as a server, enforces client\naddress validation (RFC 9000, Section 8), to confirm the peer address is not\nused for a traffic amplification attack.  If this feature is disabled on the\nserver, the QUIC stack limits the amount of server data that can be sent to 3\ntimes the amount of data received from the peer address, until such time as the\nTLS handshake is completed.\n\nThe OpenSSL QUIC server, when operating in non-validation mode, adds the\nlength of the whole datagram received to the unvalidated credit limit when\nprocessing each QUIC packet in the datagram. A remote peer may,\nafter establishing a connection with an initial client hello frame, send a\nsubsequent datagram containing multiple QUIC packets, leading the server to\naccount the entire datagram length for each packet in the datagram, resulting\nin the server believing that the peer has sent more data than it actually has,\nthereby violating the 3x amplification limit mandated by the RFC.\n\nFIPS impact: no\nAs the QUIC stack lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-35191","versionConstraint":">= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-35191","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35191","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35191","date":"2026-10-08","epss":0.00357,"percentile":0.27407}],"risk":0.11959499999999999,"urls":["https://github.com/openssl/openssl/commit/0fe4442d4f8ea3af8a174046dae176e0d4717239","https://github.com/openssl/openssl/commit/2de4c35fb13fc58f43fd8dc1d261700472ce72e5","https://github.com/openssl/openssl/commit/e44292e58b090014232ef75bd400393851b24d1a","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35191","description":"Issue summary: The OpenSSL QUIC server, when configured to not preform address\nvalidation, can be forced to count incoming packets multiple times in its\nunvalidated credit computation, leading to a violation of the RFC 9000\nunvalidated connection amplification limit of 3 times the amount of data\nreceived.\n\nImpact summary: A remote attacker able to spoof packets to a server using the\nOpenSSL QUIC implementation might use the server for an amplification of\na DDoS attack.\n\nCWE: CWE-440: Expected Behavior Violation \n\nDescription: OpenSSL's QUIC stack, when operating as a server, enforces client\naddress validation (RFC 9000, Section 8), to confirm the peer address is not\nused for a traffic amplification attack.  If this feature is disabled on the\nserver, the QUIC stack limits the amount of server data that can be sent to 3\ntimes the amount of data received from the peer address, until such time as the\nTLS handshake is completed.\n\nThe OpenSSL QUIC server, when operating in non-validation mode, adds the\nlength of the whole datagram received to the unvalidated credit limit when\nprocessing each QUIC packet in the datagram. A remote peer may,\nafter establishing a connection with an initial client hello frame, send a\nsubsequent datagram containing multiple QUIC packets, leading the server to\naccount the entire datagram length for each packet in the datagram, resulting\nin the server believing that the peer has sent more data than it actually has,\nthereby violating the 3x amplification limit mandated by the RFC.\n\nFIPS impact: no\nAs the QUIC stack lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."},"relatedVulnerabilities":[]},{"artifact":{"id":"f74a0a96746e4842","cpes":["cpe:2.3:a:org.springframework.security:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_web:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.6:*:*:*:*:*:*:*"],"name":"spring-security-web","purl":"pkg:maven/org.springframework.security/spring-security-web@6.5.6","type":"java-archive","version":"6.5.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-web-6.5.6.jar","manifestName":"","pomArtifactID":"spring-security-web","archiveDigests":[{"value":"7428000af55e700e10c0378cad694ed23fda59be","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-web-6.5.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-293q-567p-wmwq","versionConstraint":">=6.5.0,<=6.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-web","version":"6.5.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-293q-567p-wmwq","fix":{"state":"fixed","versions":["6.5.11"],"available":[{"date":"2026-07-01","kind":"first-observed","version":"6.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47838","cwe":"CWE-287","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-47838","date":"2026-10-08","epss":0.00194,"percentile":0.08318}],"risk":0.11445999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-47838","https://spring.io/security/cve-2026-47838","https://github.com/advisories/GHSA-2jrg-rf5x-568g"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-293q-567p-wmwq","description":"Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates"},"relatedVulnerabilities":[{"id":"CVE-2026-47838","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47838","cwe":"CWE-287","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-47838","date":"2026-10-08","epss":0.00194,"percentile":0.08318}],"urls":["https://spring.io/security/cve-2026-47838"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47838","description":"SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.\n\nAffected versions:\nSpring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10."}]},{"artifact":{"id":"0f414d38ffd220f0","cpes":["cpe:2.3:a:logback-core:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback-core:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos-ch:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos-ch:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos_ch:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos_ch:logback_core:1.5.19:*:*:*:*:*:*:*"],"name":"logback-core","purl":"pkg:maven/ch.qos.logback/logback-core@1.5.19","type":"java-archive","version":"1.5.19","language":"java","licenses":["http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"ch.qos.logback","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/logback-core-1.5.19.jar","manifestName":"","pomArtifactID":"logback-core","archiveDigests":[{"value":"8847d9fcb02c62c338ba26e2b28059dd585ea1a9","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/logback-core-1.5.19.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.5.33"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p47f-322f-whfh","versionConstraint":"<=1.5.32 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"ch.qos.logback:logback-core","version":"1.5.19"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p47f-322f-whfh","fix":{"state":"fixed","versions":["1.5.33"],"available":[{"date":"2026-07-02","kind":"first-observed","version":"1.5.33"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/RE:L/U:Green","metrics":{"baseScore":1.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9828","cwe":"CWE-502","type":"Secondary","source":"vulnerability@ncsc.ch"}],"epss":[{"cve":"CVE-2026-9828","date":"2026-10-08","epss":0.00545,"percentile":0.43985}],"risk":0.11445,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-9828","https://logback.qos.ch/news.html#1.5.33"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p47f-322f-whfh","description":"QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-9828","cvss":[{"type":"Secondary","source":"vulnerability@ncsc.ch","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:Green","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9828","cwe":"CWE-502","type":"Secondary","source":"vulnerability@ncsc.ch"}],"epss":[{"cve":"CVE-2026-9828","date":"2026-10-08","epss":0.00545,"percentile":0.43985}],"urls":["https://logback.qos.ch/news.html#1.5.33"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9828","description":"Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to \nSimpleSocketServer or SimpleSSLSocketServer can instantiate objects from\n classes in the java.lang and java.util packages that are not explicitly\n blocked.\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no \npractical way to achieve remote code execution or significant privilege \nescalation has been identified, this issue constitutes a bypass of the \nintended security restrictions.\n\n\n\nThis issue affects logback: through 1.5.32 inclusive."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-75805","versionConstraint":">= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-75805","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75805","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75805","date":"2026-10-08","epss":0.00222,"percentile":0.1171}],"risk":0.11433000000000001,"urls":["https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166","https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7","https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3","https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75805","description":"Issue summary: A CMP client that requests certificate revocation on the basis\nof a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when\nprocessing a crafted revocation response. \n\nImpact summary: The NULL pointer dereference happens on a read which \nleads to a crash and a Denial of Service for the affected client application.\n\nCWE: CWE-476: NULL-pointer dereference\n\nDescription: A CMP client revoking a certificate has to tell the server which\ncertificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the\ncertificate itself or its issuer name and serial number. This is\n'openssl cmp -cmd rr -csr <file>' on the command line, or\nOSSL_CMP_exec_RR_ses() with the certificate supplied via\nOSSL_CMP_CTX_set1_p10CSR() through the API.\n\nA CSR does not contain the issuer name and serial number of the certificate,\nso the client does not send them. A server may optionally name the\ncertificate it revoked in its response, and the client then compares that\nname against what it sent. Having sent neither an issuer name nor a serial\nnumber, it has nothing to compare against, and a server returning a specially\ncrafted name causes the client to read from a NULL pointer and crash.\n\nThe revocation response is checked for valid message protection before\nthe affected code is reached, so an attacker must be a malicious or\ncompromised CMP server, or a man-in-the-middle in possession of the\nsecret used for message protection. Clients that identify the certificate\nto be revoked by a certificate or by issuer and serial number rather\nthan by a PKCS#10 CSR are not affected.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-75805","versionConstraint":">= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-75805","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75805","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75805","date":"2026-10-08","epss":0.00222,"percentile":0.1171}],"risk":0.11433000000000001,"urls":["https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166","https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7","https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3","https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75805","description":"Issue summary: A CMP client that requests certificate revocation on the basis\nof a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when\nprocessing a crafted revocation response. \n\nImpact summary: The NULL pointer dereference happens on a read which \nleads to a crash and a Denial of Service for the affected client application.\n\nCWE: CWE-476: NULL-pointer dereference\n\nDescription: A CMP client revoking a certificate has to tell the server which\ncertificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the\ncertificate itself or its issuer name and serial number. This is\n'openssl cmp -cmd rr -csr <file>' on the command line, or\nOSSL_CMP_exec_RR_ses() with the certificate supplied via\nOSSL_CMP_CTX_set1_p10CSR() through the API.\n\nA CSR does not contain the issuer name and serial number of the certificate,\nso the client does not send them. A server may optionally name the\ncertificate it revoked in its response, and the client then compares that\nname against what it sent. Having sent neither an issuer name nor a serial\nnumber, it has nothing to compare against, and a server returning a specially\ncrafted name causes the client to read from a NULL pointer and crash.\n\nThe revocation response is checked for valid message protection before\nthe affected code is reached, so an attacker must be a malicious or\ncompromised CMP server, or a man-in-the-middle in possession of the\nsecret used for message protection. Clients that identify the certificate\nto be revoked by a certificate or by issuer and serial number rather\nthan by a PKCS#10 CSR are not affected.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-75805","versionConstraint":">= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-75805","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75805","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75805","date":"2026-10-08","epss":0.00222,"percentile":0.1171}],"risk":0.11433000000000001,"urls":["https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166","https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7","https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3","https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75805","description":"Issue summary: A CMP client that requests certificate revocation on the basis\nof a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when\nprocessing a crafted revocation response. \n\nImpact summary: The NULL pointer dereference happens on a read which \nleads to a crash and a Denial of Service for the affected client application.\n\nCWE: CWE-476: NULL-pointer dereference\n\nDescription: A CMP client revoking a certificate has to tell the server which\ncertificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the\ncertificate itself or its issuer name and serial number. This is\n'openssl cmp -cmd rr -csr <file>' on the command line, or\nOSSL_CMP_exec_RR_ses() with the certificate supplied via\nOSSL_CMP_CTX_set1_p10CSR() through the API.\n\nA CSR does not contain the issuer name and serial number of the certificate,\nso the client does not send them. A server may optionally name the\ncertificate it revoked in its response, and the client then compares that\nname against what it sent. Having sent neither an issuer name nor a serial\nnumber, it has nothing to compare against, and a server returning a specially\ncrafted name causes the client to read from a NULL pointer and crash.\n\nThe revocation response is checked for valid message protection before\nthe affected code is reached, so an attacker must be a malicious or\ncompromised CMP server, or a man-in-the-middle in possession of the\nsecret used for message protection. Clients that identify the certificate\nto be revoked by a certificate or by issuer and serial number rather\nthan by a PKCS#10 CSR are not affected.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"0f414d38ffd220f0","cpes":["cpe:2.3:a:logback-core:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback-core:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos-ch:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos-ch:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos_ch:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos_ch:logback_core:1.5.19:*:*:*:*:*:*:*"],"name":"logback-core","purl":"pkg:maven/ch.qos.logback/logback-core@1.5.19","type":"java-archive","version":"1.5.19","language":"java","licenses":["http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"ch.qos.logback","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/logback-core-1.5.19.jar","manifestName":"","pomArtifactID":"logback-core","archiveDigests":[{"value":"8847d9fcb02c62c338ba26e2b28059dd585ea1a9","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/logback-core-1.5.19.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.5.34"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jhq6-gfmj-v8fx","versionConstraint":"<1.5.34 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"ch.qos.logback:logback-core","version":"1.5.19"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jhq6-gfmj-v8fx","fix":{"state":"fixed","versions":["1.5.34"],"available":[{"date":"2026-07-16","kind":"first-observed","version":"1.5.34"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/RE:M/U:Green","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10532","cwe":"CWE-502","type":"Secondary","source":"vulnerability@ncsc.ch"}],"epss":[{"cve":"CVE-2026-10532","date":"2026-10-08","epss":0.0037,"percentile":0.28843}],"risk":0.10915,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-10532","https://logback.qos.ch/news.html#1.5.34","https://github.com/qos-ch/logback/releases/tag/v_1.5.34"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jhq6-gfmj-v8fx","description":"Logback vulnerable to Object Injection through HardenedObjectInputStream modules"},"relatedVulnerabilities":[{"id":"CVE-2026-10532","cvss":[{"type":"Secondary","source":"vulnerability@ncsc.ch","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Green","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10532","cwe":"CWE-502","type":"Secondary","source":"vulnerability@ncsc.ch"}],"epss":[{"cve":"CVE-2026-10532","date":"2026-10-08","epss":0.0037,"percentile":0.28843}],"urls":["https://logback.qos.ch/news.html#1.5.34"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10532","description":"Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to \nSimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.\n\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no \npractical way to achieve remote code execution or significant privilege \nescalation has been identified, this issue constitutes a bypass of the \nintended security restrictions.\n\n\n\nThis issue affects logback: through 1.5.33 inclusive."}]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54875","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54875","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54875","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54875","date":"2026-10-08","epss":0.00294,"percentile":0.20137}],"risk":0.09849,"urls":["https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257","https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8","https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28","https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54875","description":"Issue summary: A non-constant-time optimized implementation of scalar\npoint multiplication is used for SM2 private key operations on ARM64 and\nRISC-V platforms.\n\nImpact summary: An attacker able to measure the time taken by, or to observe\nthe cache-line access pattern of SM2 signing or decryption on an affected\nplatform can learn information about the secret scalar.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: On ARM64 and RISC-V processors, the SM2 curve uses an optimized\nscalar multiplication implementation whose conditional branches and table\nlook ups are chosen according to the bits of the secret scalar. The execution\ntime and the cache-access pattern therefore depend on the long-term private\nkey (during SM2 decryption) or the per-signature nonce (during SM2 signature\ngeneration), forming a timing and cache side-channel.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm and the optimized SM2 implementation is not part\nof the FIPS module.\n\nOpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and\nRISC-V.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.5.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.9.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.8.\n\nThis issue was reported on 2 May 2026 by Abhinav Agarwal.\nIt was independently reported on 6 June 2026 by Feng Xue.\nThe fix was developed by Igor Ustinov.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Abhinav Agarwal, Feng Xue\nFixed by: Igor Ustinov"},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54875","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54875","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54875","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54875","date":"2026-10-08","epss":0.00294,"percentile":0.20137}],"risk":0.09849,"urls":["https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257","https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8","https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28","https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54875","description":"Issue summary: A non-constant-time optimized implementation of scalar\npoint multiplication is used for SM2 private key operations on ARM64 and\nRISC-V platforms.\n\nImpact summary: An attacker able to measure the time taken by, or to observe\nthe cache-line access pattern of SM2 signing or decryption on an affected\nplatform can learn information about the secret scalar.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: On ARM64 and RISC-V processors, the SM2 curve uses an optimized\nscalar multiplication implementation whose conditional branches and table\nlook ups are chosen according to the bits of the secret scalar. The execution\ntime and the cache-access pattern therefore depend on the long-term private\nkey (during SM2 decryption) or the per-signature nonce (during SM2 signature\ngeneration), forming a timing and cache side-channel.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm and the optimized SM2 implementation is not part\nof the FIPS module.\n\nOpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and\nRISC-V.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.5.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.9.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.8.\n\nThis issue was reported on 2 May 2026 by Abhinav Agarwal.\nIt was independently reported on 6 June 2026 by Feng Xue.\nThe fix was developed by Igor Ustinov.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Abhinav Agarwal, Feng Xue\nFixed by: Igor Ustinov"},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54875","versionConstraint":">= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54875","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54875","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54875","date":"2026-10-08","epss":0.00294,"percentile":0.20137}],"risk":0.09849,"urls":["https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257","https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8","https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28","https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54875","description":"Issue summary: A non-constant-time optimized implementation of scalar\npoint multiplication is used for SM2 private key operations on ARM64 and\nRISC-V platforms.\n\nImpact summary: An attacker able to measure the time taken by, or to observe\nthe cache-line access pattern of SM2 signing or decryption on an affected\nplatform can learn information about the secret scalar.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: On ARM64 and RISC-V processors, the SM2 curve uses an optimized\nscalar multiplication implementation whose conditional branches and table\nlook ups are chosen according to the bits of the secret scalar. The execution\ntime and the cache-access pattern therefore depend on the long-term private\nkey (during SM2 decryption) or the per-signature nonce (during SM2 signature\ngeneration), forming a timing and cache side-channel.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm and the optimized SM2 implementation is not part\nof the FIPS module.\n\nOpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and\nRISC-V.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.5.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.9.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.8.\n\nThis issue was reported on 2 May 2026 by Abhinav Agarwal.\nIt was independently reported on 6 June 2026 by Feng Xue.\nThe fix was developed by Igor Ustinov.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Abhinav Agarwal, Feng Xue\nFixed by: Igor Ustinov"},"relatedVulnerabilities":[]},{"artifact":{"id":"c1259b13a75d502a","cpes":["cpe:2.3:a:org.springframework.boot:spring-boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.boot:spring_boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.boot:boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot:spring-boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot:spring_boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot:spring-boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot:spring_boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:boot:spring-boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:boot:spring_boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot:boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot:boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:boot:boot:3.3.11:*:*:*:*:*:*:*"],"name":"spring-boot","purl":"pkg:maven/org.springframework.boot/spring-boot@3.3.11","type":"java-archive","version":"3.3.11","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.boot","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-boot-3.3.11.jar","manifestName":"","pomArtifactID":"spring-boot","archiveDigests":[{"value":"b1f0b53e38e2bf45eae8f5bd27983a07bdeaac30","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-boot-3.3.11.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wwpq-f5c3-7hvx","versionConstraint":">=3.3.0,<=3.3.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.boot:spring-boot","version":"3.3.11"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wwpq-f5c3-7hvx","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40973","cwe":"CWE-377","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-40973","date":"2026-10-08","epss":0.00134,"percentile":0.0251}],"risk":0.09715,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-40973","https://spring.io/security/cve-2026-40973"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wwpq-f5c3-7hvx","description":"Spring Boot accepts predictable temp directory without ownership verification"},"relatedVulnerabilities":[{"id":"CVE-2026-40973","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40973","cwe":"CWE-377","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-40973","date":"2026-10-08","epss":0.00134,"percentile":0.0251}],"urls":["https://spring.io/security/cve-2026-40973"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40973","description":"A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory."}]},{"artifact":{"id":"0db452b47767fa3e","cpes":["cpe:2.3:a:org.springframework:spring-web:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:6.2.11:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@6.2.11","type":"java-archive","version":"6.2.11","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-web-6.2.11.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"e590ac3e1aaea2d34a5ccb5c25ad84acbada8468","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-web-6.2.11.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7m2p-62gw-p8qq","versionConstraint":">=6.2.0,<=6.2.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"6.2.11"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7m2p-62gw-p8qq","fix":{"state":"fixed","versions":["6.2.19"],"available":[{"date":"2026-08-07","kind":"first-observed","version":"6.2.19"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41854","cwe":"CWE-918","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41854","date":"2026-10-08","epss":0.00209,"percentile":0.10182}],"risk":0.09613999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41854","https://spring.io/security/cve-2026-41854"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7m2p-62gw-p8qq","description":"Spring Framework Server-Side Request Forgery via UriComponentsBuilder"},"relatedVulnerabilities":[{"id":"CVE-2026-41854","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41854","cwe":"CWE-918","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41854","date":"2026-10-08","epss":0.00209,"percentile":0.10182}],"urls":["https://spring.io/security/cve-2026-41854"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41854","description":"Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18."}]},{"artifact":{"id":"d4ab3efc304a4e30","cpes":["cpe:2.3:a:openjdk21:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk21:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*"],"name":"openjdk21","purl":"pkg:apk/alpine/openjdk21@21.0.12_p8-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"21.0.12_p8-r0","language":"","licenses":["GPL-2.0-with-classpath-exception"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/jvm"},{"path":"/usr/lib/jvm/java-21-openjdk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openjdk21"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-60589","versionConstraint":"< 1.8.0_504||>= 1.9, < 8.0.504||>= 12, < 17.0.20.1||>= 18, < 21.0.12.1||>= 22, < 25.0.4.1||>= 26, < 26.0.2.1||>= 9, < 11.0.32.1 (jvm)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.12_p8:*:*:*:*:*:*:*"],"package":{"name":"openjdk21","version":"21.0.12_p8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-60589","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60589","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60589","date":"2026-10-08","epss":0.00265,"percentile":0.16907}],"risk":0.08877499999999999,"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60589","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54872","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54872","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-10-08","epss":0.00263,"percentile":0.16589}],"risk":0.08810499999999999,"urls":["https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179","https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb","https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd","https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54872","description":"Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a dedicated constant-time implementation pads the\nsecret scalar with non-constant-time BIGNUM operations, so the time taken\ndepends on the value of the secret scalar derived from the ECDSA and SM2 nonce.\n\nThe leak is very small; observing it requires a large number of\nmeasurements. The effect is largest for curves whose group order lies\non a machine-word boundary, such as brainpoolP384r1.\n\nApplications using ECDSA signing over the Brainpool and other generic prime\ncurves, and SM2 signing on platforms that use the generic implementation,\nare vulnerable to this issue.\n\nThe NIST curves P-256, P-384 and P-521 use dedicated constant-time\nimplementations and are not affected.\n\nFIPS Impact: no\nThe FIPS modules are not affected: the approved NIST curves used in the FIPS\nprovider have dedicated constant-time implementations and do not use the\naffected code path."},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54872","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54872","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-10-08","epss":0.00263,"percentile":0.16589}],"risk":0.08810499999999999,"urls":["https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179","https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb","https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd","https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54872","description":"Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a dedicated constant-time implementation pads the\nsecret scalar with non-constant-time BIGNUM operations, so the time taken\ndepends on the value of the secret scalar derived from the ECDSA and SM2 nonce.\n\nThe leak is very small; observing it requires a large number of\nmeasurements. The effect is largest for curves whose group order lies\non a machine-word boundary, such as brainpoolP384r1.\n\nApplications using ECDSA signing over the Brainpool and other generic prime\ncurves, and SM2 signing on platforms that use the generic implementation,\nare vulnerable to this issue.\n\nThe NIST curves P-256, P-384 and P-521 use dedicated constant-time\nimplementations and are not affected.\n\nFIPS Impact: no\nThe FIPS modules are not affected: the approved NIST curves used in the FIPS\nprovider have dedicated constant-time implementations and do not use the\naffected code path."},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54872","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54872","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-10-08","epss":0.00263,"percentile":0.16589}],"risk":0.08810499999999999,"urls":["https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179","https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb","https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd","https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54872","description":"Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a dedicated constant-time implementation pads the\nsecret scalar with non-constant-time BIGNUM operations, so the time taken\ndepends on the value of the secret scalar derived from the ECDSA and SM2 nonce.\n\nThe leak is very small; observing it requires a large number of\nmeasurements. The effect is largest for curves whose group order lies\non a machine-word boundary, such as brainpoolP384r1.\n\nApplications using ECDSA signing over the Brainpool and other generic prime\ncurves, and SM2 signing on platforms that use the generic implementation,\nare vulnerable to this issue.\n\nThe NIST curves P-256, P-384 and P-521 use dedicated constant-time\nimplementations and are not affected.\n\nFIPS Impact: no\nThe FIPS modules are not affected: the approved NIST curves used in the FIPS\nprovider have dedicated constant-time implementations and do not use the\naffected code path."},"relatedVulnerabilities":[]},{"artifact":{"id":"c50fc4b8c2e0786a","cpes":["cpe:2.3:a:io.netty.transport-native-epoll.linux-x86_64:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-native-epoll.linux-x86_64:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-native-epoll.linux-x86_64:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-native-epoll.linux-x86_64:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-epoll:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-epoll:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_epoll:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_epoll:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-epoll:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-epoll:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_epoll:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_epoll:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-epoll:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-epoll:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_epoll:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_epoll:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-epoll:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-epoll:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_epoll:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_epoll:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86-64:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86-64:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86_64:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86_64:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86_64:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86_64:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86-64:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86-64:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86_64:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86_64:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86_64:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86_64:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:transport-native-epoll:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:transport_native_epoll:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-transport-native-epoll","purl":"pkg:maven/io.netty/netty-transport-native-epoll@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-transport-native-epoll-4.2.9.Final-linux-x86_64.jar","manifestName":"","pomArtifactID":"netty-transport-native-epoll","archiveDigests":[{"value":"345e9bc0118e2d0bb498d0fa10947a3295d30496","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-transport-native-epoll-4.2.9.Final-linux-x86_64.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w573-9ffj-6ff9","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-transport-native-epoll","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w573-9ffj-6ff9","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45536","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45536","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45536","date":"2026-10-08","epss":0.00193,"percentile":0.0815}],"risk":0.08685,"urls":["https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45536"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w573-9ffj-6ff9","description":"Netty: Unix-socket fd receive leaks descriptors when peer sends two at once"},"relatedVulnerabilities":[{"id":"CVE-2026-45536","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45536","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45536","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45536","date":"2026-10-08","epss":0.00193,"percentile":0.0815}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45536","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"9de00f1d1e3d423f","cpes":["cpe:2.3:a:io.netty.transport-native-kqueue.osx-x86_64:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-native-kqueue.osx-x86_64:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-native-kqueue.osx-x86_64:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-native-kqueue.osx-x86_64:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-kqueue:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-kqueue:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_kqueue:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_kqueue:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-kqueue:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-kqueue:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_kqueue:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_kqueue:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-kqueue:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-kqueue:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_kqueue:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_kqueue:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-kqueue:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-kqueue:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_kqueue:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_kqueue:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86-64:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86-64:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86_64:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86_64:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86_64:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86_64:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86-64:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86-64:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86_64:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86_64:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86_64:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86_64:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx:netty-transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx:netty_transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx:transport-native-kqueue:4.2.9.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx:transport_native_kqueue:4.2.9.Final:*:*:*:*:*:*:*"],"name":"netty-transport-native-kqueue","purl":"pkg:maven/io.netty/netty-transport-native-kqueue@4.2.9.Final","type":"java-archive","version":"4.2.9.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-transport-native-kqueue-4.2.9.Final-osx-x86_64.jar","manifestName":"","pomArtifactID":"netty-transport-native-kqueue","archiveDigests":[{"value":"c30525d2cdb80b9819cec2234f7024868d495a9b","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/netty-transport-native-kqueue-4.2.9.Final-osx-x86_64.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w573-9ffj-6ff9","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-transport-native-kqueue","version":"4.2.9.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w573-9ffj-6ff9","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45536","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45536","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45536","date":"2026-10-08","epss":0.00193,"percentile":0.0815}],"risk":0.08685,"urls":["https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45536"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w573-9ffj-6ff9","description":"Netty: Unix-socket fd receive leaks descriptors when peer sends two at once"},"relatedVulnerabilities":[{"id":"CVE-2026-45536","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45536","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45536","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45536","date":"2026-10-08","epss":0.00193,"percentile":0.0815}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45536","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"640a0ea1e3caeec6","cpes":["cpe:2.3:a:org.springframework:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring_expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring_expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-expression:6.2.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_expression:6.2.11:*:*:*:*:*:*:*"],"name":"spring-expression","purl":"pkg:maven/org.springframework/spring-expression@6.2.11","type":"java-archive","version":"6.2.11","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-expression-6.2.11.jar","manifestName":"","pomArtifactID":"spring-expression","archiveDigests":[{"value":"7190c1c69576516efef1a061d956dccf17cb0b86","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-expression-6.2.11.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9f52-rjqv-25qv","versionConstraint":">=6.2.0,<=6.2.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-expression","version":"6.2.11"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9f52-rjqv-25qv","fix":{"state":"fixed","versions":["6.2.19"],"available":[{"date":"2026-07-31","kind":"first-observed","version":"6.2.19"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41852","cwe":"CWE-863","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41852","date":"2026-10-08","epss":0.00259,"percentile":0.16118}],"risk":0.08676499999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41852","https://spring.io/security/cve-2026-41852","https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19","https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9f52-rjqv-25qv","description":"Spring Framework Arbitrary Method Invocation in SpEL Expressions"},"relatedVulnerabilities":[{"id":"CVE-2026-41852","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41852","cwe":"CWE-863","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41852","date":"2026-10-08","epss":0.00259,"percentile":0.16118}],"urls":["https://spring.io/security/cve-2026-41852"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41852","description":"A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48."}]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-90781","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-90781","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90781","cwe":"CWE-193","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-90781","date":"2026-10-08","epss":0.0017,"percentile":0.0582}],"risk":0.08159999999999999,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c#L216-L241","https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020","https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-off-by-one-stack-buffer-overflow-in-snd-ctl-ascii-elem-id-parse"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90781","description":"alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process."},"relatedVulnerabilities":[]},{"artifact":{"id":"e23c248c64dfa980","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-77696","versionConstraint":">= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-77696","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-10-08","epss":0.00243,"percentile":0.14252}],"risk":0.08140499999999999,"urls":["https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9","https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb","https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64","https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696","description":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm."},"relatedVulnerabilities":[]},{"artifact":{"id":"7de879f497a38539","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.7-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-77696","versionConstraint":">= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-77696","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-10-08","epss":0.00243,"percentile":0.14252}],"risk":0.08140499999999999,"urls":["https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9","https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb","https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64","https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696","description":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm."},"relatedVulnerabilities":[]},{"artifact":{"id":"6d60a37544bb98cc","cpes":["cpe:2.3:a:openssl:openssl:3.5.7-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"3.5.7-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-77696","versionConstraint":">= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:3.5.7:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"3.5.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-77696","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-10-08","epss":0.00243,"percentile":0.14252}],"risk":0.08140499999999999,"urls":["https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9","https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb","https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64","https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696","description":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm."},"relatedVulnerabilities":[]},{"artifact":{"id":"7ff846230526fb98","cpes":["cpe:2.3:a:org.springframework.security:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:vmware:security:6.5.6:*:*:*:*:*:*:*"],"name":"spring-security-core","purl":"pkg:maven/org.springframework.security/spring-security-core@6.5.6","type":"java-archive","version":"6.5.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-core-6.5.6.jar","manifestName":"","pomArtifactID":"spring-security-core","archiveDigests":[{"value":"a1bc1afabfab5cbee9179c134f41d10b4351a001","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-core-6.5.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vxf7-qj7q-83fh","versionConstraint":">=6.5.0,<=6.5.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-core","version":"6.5.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vxf7-qj7q-83fh","fix":{"state":"fixed","versions":["6.5.10"],"available":[{"date":"2026-04-30","kind":"first-observed","version":"6.5.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22746","cwe":"CWE-208","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-22746","date":"2026-10-08","epss":0.00215,"percentile":0.10917}],"risk":0.07202499999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-22746","https://spring.io/security/cve-2026-22746"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vxf7-qj7q-83fh","description":"Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider"},"relatedVulnerabilities":[{"id":"CVE-2026-22746","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22746","cwe":"CWE-208","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-22746","date":"2026-10-08","epss":0.00215,"percentile":0.10917}],"urls":["https://spring.io/security/cve-2026-22746"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22746","description":"Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4."}]},{"artifact":{"id":"77cdad3ced29bb9d","cpes":["cpe:2.3:a:spring-boot-autoconfigure:spring-boot-autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot-autoconfigure:spring_boot_autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot_autoconfigure:spring-boot-autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot_autoconfigure:spring_boot_autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.boot:spring-boot-autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.boot:spring_boot_autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-boot-autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_boot_autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot:spring-boot-autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot:spring_boot_autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot:spring-boot-autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot:spring_boot_autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-boot-autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_boot_autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:boot:spring-boot-autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:boot:spring_boot_autoconfigure:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot-autoconfigure:boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot_autoconfigure:boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.boot:boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:springframework:boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot:boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot:boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:spring:boot:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:boot:boot:3.3.11:*:*:*:*:*:*:*"],"name":"spring-boot-autoconfigure","purl":"pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.3.11","type":"java-archive","version":"3.3.11","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.boot","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-boot-autoconfigure-3.3.11.jar","manifestName":"","pomArtifactID":"spring-boot-autoconfigure","archiveDigests":[{"value":"322a02cfbd787e408aa122c4e76b79e12e830a0e","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-boot-autoconfigure-3.3.11.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ggg2-9786-hwc8","versionConstraint":">=3.3.0,<=3.3.19 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.boot:spring-boot-autoconfigure","version":"3.3.11"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-ggg2-9786-hwc8","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41001","cwe":"CWE-377","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41001","date":"2026-10-08","epss":0.00132,"percentile":0.02392}],"risk":0.06798,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41001","https://spring.io/security/cve-2026-41001","https://github.com/spring-projects/spring-boot/commit/4218bd76e934e5cf9e3fd3997c67b8a6b0d0c111"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ggg2-9786-hwc8","description":"Spring Boot: Predictable Temp Directory in Artemis Auto-configuration"},"relatedVulnerabilities":[{"id":"CVE-2026-41001","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41001","cwe":"CWE-377","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41001","date":"2026-10-08","epss":0.00132,"percentile":0.02392}],"urls":["https://spring.io/security/cve-2026-41001"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41001","description":"Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.\n\nAffected versions:\nSpring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33."}]},{"artifact":{"id":"db0be20435ff9026","cpes":["cpe:2.3:a:gnu:tar:1.35-r5:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:1.35-r5:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:apk/alpine/tar@1.35-r5?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"1.35-r5","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/tar"},{"path":"/usr"},{"path":"/usr/libexec"},{"path":"/usr/libexec/rmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tar"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-18508","versionConstraint":"= 1.35 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*"],"package":{"name":"tar","version":"1.35-r5"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-18508","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18508","date":"2026-10-08","epss":0.00141,"percentile":0.02947}],"risk":0.06627,"urls":["https://access.redhat.com/errata/RHSA-2026:50807","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18508","https://bugzilla.redhat.com/show_bug.cgi?id=2509843"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction."},"relatedVulnerabilities":[]},{"artifact":{"id":"7ff846230526fb98","cpes":["cpe:2.3:a:org.springframework.security:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring-security-core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_security_core:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:vmware:security:6.5.6:*:*:*:*:*:*:*"],"name":"spring-security-core","purl":"pkg:maven/org.springframework.security/spring-security-core@6.5.6","type":"java-archive","version":"6.5.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-core-6.5.6.jar","manifestName":"","pomArtifactID":"spring-security-core","archiveDigests":[{"value":"a1bc1afabfab5cbee9179c134f41d10b4351a001","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-core-6.5.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x2wq-9x2f-fhj7","versionConstraint":">=6.5.0,<6.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-core","version":"6.5.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x2wq-9x2f-fhj7","fix":{"state":"fixed","versions":["6.5.10"],"available":[{"date":"2026-04-26","kind":"first-observed","version":"6.5.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22751","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-22751","date":"2026-10-08","epss":0.00124,"percentile":0.01917}],"risk":0.06076,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-22751","https://spring.io/security/cve-2026-22751","https://github.com/spring-projects/spring-security/commit/163772775036c4146815a5266874278c6f45f047","https://github.com/spring-projects/spring-security/commit/4187af38b251fc97fdf9949f7869618111e6e261","https://jinyeong.seol.pro/blogs/cve-2026-22751/en"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x2wq-9x2f-fhj7","description":"Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured"},"relatedVulnerabilities":[{"id":"CVE-2026-22751","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22751","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-22751","date":"2026-10-08","epss":0.00124,"percentile":0.01917}],"urls":["https://spring.io/security/cve-2026-22751"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22751","description":"Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4."}]},{"artifact":{"id":"d915eaa34f2bddf6","cpes":["cpe:2.3:a:spring-security-saml2-service-provider:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service-provider:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service-provider:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-saml2-service-provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_saml2_service_provider:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.6:*:*:*:*:*:*:*"],"name":"spring-security-saml2-service-provider","purl":"pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.6","type":"java-archive","version":"6.5.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-saml2-service-provider-6.5.6.jar","manifestName":"","pomArtifactID":"spring-security-saml2-service-provider","archiveDigests":[{"value":"c1db9cba3dac366d16162dc7a71f3a42146bbd8d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/spring-security-saml2-service-provider-6.5.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ww38-37g9-m3q3","versionConstraint":">=6.5.0,<=6.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-saml2-service-provider","version":"6.5.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-ww38-37g9-m3q3","fix":{"state":"fixed","versions":["6.5.11"],"available":[{"date":"2026-08-12","kind":"first-observed","version":"6.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41694","cwe":"CWE-347","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41694","date":"2026-10-08","epss":0.00181,"percentile":0.07036}],"risk":0.060634999999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41694","https://spring.io/security/cve-2026-41694","https://github.com/spring-projects/spring-security/releases/tag/6.5.11","https://github.com/spring-projects/spring-security/releases/tag/7.0.6"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ww38-37g9-m3q3","description":"Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads"},"relatedVulnerabilities":[{"id":"CVE-2026-41694","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41694","cwe":"CWE-347","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41694","date":"2026-10-08","epss":0.00181,"percentile":0.07036}],"urls":["https://spring.io/security/cve-2026-41694"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41694","description":"Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.\n\nAffected versions:\nSpring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5."}]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96674","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96674","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96674","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96674","date":"2026-10-08","epss":0.00115,"percentile":0.01438}],"risk":0.0552,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1316-L1326","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1420-L1430","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1511-L1521","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-integer-overflow-via-topology-file"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96674","description":"alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application."},"relatedVulnerabilities":[]},{"artifact":{"id":"9afabefc092ff440","cpes":["cpe:2.3:a:org.eclipse.jetty.http:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty-http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty_http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:jetty:http:12.0.17:*:*:*:*:*:*:*","cpe:2.3:a:http:http:12.0.17:*:*:*:*:*:*:*"],"name":"jetty-http","purl":"pkg:maven/org.eclipse.jetty/jetty-http@12.0.17","type":"java-archive","version":"12.0.17","language":"java","licenses":["https://www.eclipse.org/legal/epl-2.0/, https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jetty-http-12.0.17.jar","manifestName":"","pomArtifactID":"jetty-http","archiveDigests":[{"value":"b7d355158fb2251ef3b2a43c3afa64f219c1065f","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/jetty-http-12.0.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"12.0.31"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjpw-4j6x-6rwh","versionConstraint":">=12.0.0,<=12.0.30 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-http","version":"12.0.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjpw-4j6x-6rwh","fix":{"state":"fixed","versions":["12.0.31"],"available":[{"date":"2026-03-06","kind":"first-observed","version":"12.0.31"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11143","cwe":"CWE-20","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2025-11143","date":"2026-10-08","epss":0.00161,"percentile":0.04733}],"risk":0.053935,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh","https://nvd.nist.gov/vuln/detail/CVE-2025-11143","https://github.com/user-attachments/files/22222625/Java.Eclipse.Jetty.Report_.Incorrect.Parsing.Priority.of.the.IPv6.Hostname.Delimeter.pdf","https://github.com/user-attachments/files/22222626/Java.Eclipse.Jetty.Report_.The.Parsing.Priority.of.the.Delimiter.pdf","https://github.com/user-attachments/files/22222627/Java.Eclipse.Jetty.Report_.Parsing.Difference.Due.to.Deformed.Scheme.pdf","https://github.com/user-attachments/files/22222630/Java.Eclipse.Jetty.Report_.Improper.IPv4-mapped.IPv6.Parsing.pdf"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjpw-4j6x-6rwh","description":"org.eclipse.jetty:jetty-http has different parsing of invalid URIs"},"relatedVulnerabilities":[{"id":"CVE-2025-11143","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11143","cwe":"CWE-20","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2025-11143","date":"2026-10-08","epss":0.00161,"percentile":0.04733}],"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11143","description":"The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details."}]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96675","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96675","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96675","date":"2026-10-08","epss":0.00111,"percentile":0.01223}],"risk":0.05022750000000001,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/pcm/pcm_multi.c#L1122-L1131","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-denial-of-service-via-pcm-multi"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96675","description":"alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort."},"relatedVulnerabilities":[]},{"artifact":{"id":"27567eed7ed30a6a","cpes":["cpe:2.3:a:apache:shiro-core:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro_core:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:1.13.0:*:*:*:*:*:*:*"],"name":"shiro-core","purl":"pkg:maven/org.apache.shiro/shiro-core@1.13.0","type":"java-archive","version":"1.13.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.shiro","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/shiro-core-1.13.0.jar","manifestName":"","pomArtifactID":"shiro-core","archiveDigests":[{"value":"7e542e3d614b197bf10005e98e19f9f19cb943e7","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/shiro-core-1.13.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c4qc-4q9p-m9q9","versionConstraint":"<2.1.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.shiro:shiro-core","version":"1.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c4qc-4q9p-m9q9","fix":{"state":"fixed","versions":["2.1.0"],"available":[{"date":"2026-02-10","kind":"first-observed","version":"2.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23901","cwe":"CWE-208","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-23901","date":"2026-10-08","epss":0.00245,"percentile":0.14442}],"risk":0.049,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-23901","https://lists.apache.org/thread/mm1jct9b86jvnh3y44tj22xvjtx3xhhh","http://www.openwall.com/lists/oss-security/2026/02/08/2"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c4qc-4q9p-m9q9","description":"Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-23901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Green","metrics":{"baseScore":1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23901","cwe":"CWE-208","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-23901","date":"2026-10-08","epss":0.00245,"percentile":0.14442}],"urls":["https://lists.apache.org/thread/mm1jct9b86jvnh3y44tj22xvjtx3xhhh","http://www.openwall.com/lists/oss-security/2026/02/08/2"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23901","description":"Observable Timing Discrepancy vulnerability in Apache Shiro.\n\nThis issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.\n\nUsers are recommended to upgrade to version 2.0.7 or later, which fixes the issue.\n\nPrior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough,\nthat a brute-force attack may be able to tell, by timing the requests only, determine if\nthe request failed because of a non-existent user vs. wrong password.\n\nThe most likely attack vector is a local attack only.\nShiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well.\n\nTypically, brute force attack can be mitigated at the infrastructure level."}]},{"artifact":{"id":"0f414d38ffd220f0","cpes":["cpe:2.3:a:logback-core:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback-core:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos-ch:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos-ch:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos_ch:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos_ch:logback_core:1.5.19:*:*:*:*:*:*:*"],"name":"logback-core","purl":"pkg:maven/ch.qos.logback/logback-core@1.5.19","type":"java-archive","version":"1.5.19","language":"java","licenses":["http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"ch.qos.logback","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/logback-core-1.5.19.jar","manifestName":"","pomArtifactID":"logback-core","archiveDigests":[{"value":"8847d9fcb02c62c338ba26e2b28059dd585ea1a9","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar","layerID":"sha256:8aa41ea8c4b618f63959da524f31eb6e103d479fad19ce1690c0601e9505b17f","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.90.5-01.jar:BOOT-INF/lib/logback-core-1.5.19.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.5.25"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qqpg-mvqg-649v","versionConstraint":"<1.5.25 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"ch.qos.logback:logback-core","version":"1.5.19"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qqpg-mvqg-649v","fix":{"state":"fixed","versions":["1.5.25"],"available":[{"date":"2026-01-23","kind":"first-observed","version":"1.5.25"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1225","cwe":"CWE-20","type":"Secondary","source":"vulnerability@ncsc.ch"}],"epss":[{"cve":"CVE-2026-1225","date":"2026-10-08","epss":0.00165,"percentile":0.0518}],"risk":0.039599999999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-1225","https://logback.qos.ch/news.html#1.5.25","https://github.com/qos-ch/logback/issues/997","https://github.com/qos-ch/logback/commit/1f97ae1844b1be8486e4e9cade98d7123d3eded5"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qqpg-mvqg-649v","description":"Logback allows an attacker to instantiate classes already present on the class path"},"relatedVulnerabilities":[{"id":"CVE-2026-1225","cvss":[{"type":"Secondary","source":"vulnerability@ncsc.ch","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:M/U:Green","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1225","cwe":"CWE-20","type":"Secondary","source":"vulnerability@ncsc.ch"}],"epss":[{"cve":"CVE-2026-1225","date":"2026-10-08","epss":0.00165,"percentile":0.0518}],"urls":["https://logback.qos.ch/news.html#1.5.25"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1225","description":"ACE vulnerability in configuration file processing  by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.\n\n\n\n\nThe instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must  have write access to a \nconfiguration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado."}]},{"artifact":{"id":"db0be20435ff9026","cpes":["cpe:2.3:a:gnu:tar:1.35-r5:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:1.35-r5:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:apk/alpine/tar@1.35-r5?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"1.35-r5","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/tar"},{"path":"/usr"},{"path":"/usr/libexec"},{"path":"/usr/libexec/rmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tar"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-18477","versionConstraint":"= 1.35 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*"],"package":{"name":"tar","version":"1.35-r5"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-18477","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18477","date":"2026-10-08","epss":0.0008,"percentile":0.00144}],"risk":0.0376,"urls":["https://access.redhat.com/errata/RHSA-2026:49361","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18477","https://bugzilla.redhat.com/show_bug.cgi?id=2509735"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"402f989a5c52bb95","cpes":["cpe:2.3:a:curl:curl:8.21.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80256","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80256","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-80256","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-80256"},"relatedVulnerabilities":[{"id":"CVE-2026-80256","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"a2647272222f5e72","cpes":["cpe:2.3:a:libcurl:libcurl:8.21.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.21.0-r0?arch=x86_64&distro=alpine-3.24.1&upstream=curl","type":"apk","version":"8.21.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.22.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80256","versionConstraint":"< 8.22.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"curl","version":"8.21.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-80256","fix":{"state":"fixed","versions":["8.22.0-r0"],"available":[{"date":"2026-09-03","kind":"first-observed","version":"8.22.0-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-80256"},"relatedVulnerabilities":[{"id":"CVE-2026-80256","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"85c7bb17ffa13d95","cpes":["cpe:2.3:a:libpng:libpng:1.6.58-r1:*:*:*:*:*:*:*"],"name":"libpng","purl":"pkg:apk/alpine/libpng@1.6.58-r1?arch=x86_64&distro=alpine-3.24.1","type":"apk","version":"1.6.58-r1","language":"","licenses":["Libpng"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpng16.so.16"},{"path":"/usr/lib/libpng16.so.16.58.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a834414584b8e2a6dc11780c454f47b46d5683ee401456695c1050d2a15a6422","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libpng"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.6.59-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-46675","versionConstraint":"< 1.6.59-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"libpng","version":"1.6.58-r1"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.6.59-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46675","versionConstraint":"< 1.6.59-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.1"},"package":{"name":"libpng","version":"1.6.58-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-46675","fix":{"state":"fixed","versions":["1.6.59-r0"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"1.6.59-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-46675"},"relatedVulnerabilities":[{"id":"CVE-2026-46675","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]}],"grade":"F","score":"0.00","as_of":"2026-10-10T00:07:23.976Z","grype_db_version":"2026-10-09T06:32:32.000Z"}