{"grype_matches":[{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-25","epss":0.01284,"percentile":0.6991}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-25","epss":0.01284,"percentile":0.6991}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-25","epss":0.01284,"percentile":0.6991}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-25","epss":0.01284,"percentile":0.6991}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"db0be20435ff9026","cpes":["cpe:2.3:a:gnu:tar:1.35-r5:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:1.35-r5:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:apk/alpine/tar@1.35-r5?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.35-r5","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/tar"},{"path":"/usr"},{"path":"/usr/libexec"},{"path":"/usr/libexec/rmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tar"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-5704","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*"],"package":{"name":"tar","version":"1.35-r5"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-5704","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-10-25","epss":0.0043,"percentile":0.36927}],"risk":0.220375,"urls":["https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:66514","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-5704","https://bugzilla.redhat.com/show_bug.cgi?id=2455360","http://www.openwall.com/lists/oss-security/2026/04/11/10","http://www.openwall.com/lists/oss-security/2026/04/11/11","http://www.openwall.com/lists/oss-security/2026/04/12/2"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."},"relatedVulnerabilities":[]},{"artifact":{"id":"b0d46f11fcadfdec","cpes":["cpe:2.3:a:org.sonatype.buildsupport:ognl:3.4.4:*:*:*:*:*:*:*","cpe:2.3:a:buildsupport:ognl:3.4.4:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:ognl:3.4.4:*:*:*:*:*:*:*","cpe:2.3:a:ognl:ognl:3.4.4:*:*:*:*:*:*:*"],"name":"ognl","purl":"pkg:maven/ognl/ognl@3.4.4","type":"java-archive","version":"3.4.4","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"ognl","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.97.2-02.jar:BOOT-INF/lib/mybatis-3.5.19.jar:ognl:ognl","manifestName":"","pomArtifactID":"ognl","archiveDigests":null},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.97.2-02.jar","layerID":"sha256:e6db664d3e937e8e2d0ff125945975bacec166276af5f09a115061b271ba4d97","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.97.2-02.jar:BOOT-INF/lib/mybatis-3.5.19.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.4.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-crwc-vw2r-qr6m","versionConstraint":"<=3.4.12 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"ognl:ognl","version":"3.4.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-crwc-vw2r-qr6m","fix":{"state":"fixed","versions":["3.4.13"],"available":[{"date":"2026-10-22","kind":"first-observed","version":"3.4.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113730","cwe":"CWE-693","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113730","date":"2026-10-25","epss":0.00394,"percentile":0.33355}],"risk":0.20882,"urls":["https://github.com/orphan-oss/ognl/security/advisories/GHSA-crwc-vw2r-qr6m","https://nvd.nist.gov/vuln/detail/CVE-2026-113730","https://github.com/orphan-oss/ognl/commit/16396fa4b560221294c2ab9ca04b76b161115e7d","https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2","https://github.com/orphan-oss/ognl/releases/tag/OGNL_3_4_13"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-crwc-vw2r-qr6m","description":"OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies"},"relatedVulnerabilities":[{"id":"CVE-2026-113730","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113730","cwe":"CWE-693","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113730","date":"2026-10-25","epss":0.00394,"percentile":0.33355}],"urls":["https://github.com/orphan-oss/ognl/commit/16396fa4b560221294c2ab9ca04b76b161115e7d","https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2","https://github.com/orphan-oss/ognl/releases/tag/OGNL_3_4_13","https://github.com/orphan-oss/ognl/security/advisories/GHSA-crwc-vw2r-qr6m"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113730","description":"OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. An attacker-controlled expression can invoke one of these reflection objects as a proxy for a method on a blocked class, causing the real operation to execute inside JDK reflection without passing through the stricter-invocation check again. Exploitation requires an application to evaluate untrusted OGNL expressions, use the default or an equivalently permissive MemberAccess that permits reflection, and rely on stricter invocation as a sandbox. Applications using a restrictive MemberAccess, including Apache Struts with SecurityMemberAccess, are not affected by this bypass. This issue is fixed in 3.4.13."}]},{"artifact":{"id":"d4ab3efc304a4e30","cpes":["cpe:2.3:a:openjdk21:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk21:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*"],"name":"openjdk21","purl":"pkg:apk/alpine/openjdk21@21.0.12_p8-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"21.0.12_p8-r0","language":"","licenses":["GPL-2.0-with-classpath-exception"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/jvm"},{"path":"/usr/lib/jvm/java-21-openjdk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openjdk21"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-61308","versionConstraint":"< 1.8.0_504||>= 1.9, < 8.0.504||>= 12, < 17.0.20.1||>= 18, < 21.0.12.1||>= 22, < 25.0.4.1||>= 26, < 26.0.2.1||>= 9, < 11.0.32.1 (jvm)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.12_p8:*:*:*:*:*:*:*"],"package":{"name":"openjdk21","version":"21.0.12_p8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-61308","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61308","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61308","date":"2026-10-25","epss":0.0031,"percentile":0.23608}],"risk":0.18289999999999998,"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61308","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"fef07e9c95ea2bda","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-25","epss":0.00312,"percentile":0.23868}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"915155597fcdee9a","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-25","epss":0.00312,"percentile":0.23868}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8a9ef44e1018f213","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-25","epss":0.00312,"percentile":0.23868}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-25","epss":0.00297,"percentile":0.22141}],"risk":0.1485,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-25","epss":0.00297,"percentile":0.22141}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-25","epss":0.00297,"percentile":0.22141}],"risk":0.1485,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-25","epss":0.00297,"percentile":0.22141}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"d4ab3efc304a4e30","cpes":["cpe:2.3:a:openjdk21:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk21:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*"],"name":"openjdk21","purl":"pkg:apk/alpine/openjdk21@21.0.12_p8-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"21.0.12_p8-r0","language":"","licenses":["GPL-2.0-with-classpath-exception"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/jvm"},{"path":"/usr/lib/jvm/java-21-openjdk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openjdk21"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70907","versionConstraint":"< 1.8.0_504||>= 1.9, < 8.0.504||>= 12, < 17.0.20.1||>= 18, < 21.0.12.1||>= 22, < 25.0.4.1||>= 26, < 26.0.2.1||>= 9, < 11.0.32.1 (jvm)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.12_p8:*:*:*:*:*:*:*"],"package":{"name":"openjdk21","version":"21.0.12_p8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70907","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70907","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-70907","date":"2026-10-25","epss":0.00278,"percentile":0.2002}],"risk":0.14317,"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70907","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-25","epss":0.00282,"percentile":0.20551}],"risk":0.14100000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-25","epss":0.00282,"percentile":0.20551}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-25","epss":0.00282,"percentile":0.20551}],"risk":0.14100000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-25","epss":0.00282,"percentile":0.20551}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-25","epss":0.00279,"percentile":0.20108}],"risk":0.13949999999999999,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-25","epss":0.00279,"percentile":0.20108}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-25","epss":0.00279,"percentile":0.20108}],"risk":0.13949999999999999,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-25","epss":0.00279,"percentile":0.20108}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-25","epss":0.00262,"percentile":0.17882}],"risk":0.131,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-25","epss":0.00262,"percentile":0.17882}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-25","epss":0.00262,"percentile":0.17882}],"risk":0.131,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-25","epss":0.00262,"percentile":0.17882}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-25","epss":0.0026,"percentile":0.17558}],"risk":0.13,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-25","epss":0.0026,"percentile":0.17558}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-25","epss":0.0026,"percentile":0.17558}],"risk":0.13,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-25","epss":0.0026,"percentile":0.17558}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-25","epss":0.00259,"percentile":0.17432}],"risk":0.1295,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-25","epss":0.00259,"percentile":0.17432}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-25","epss":0.00259,"percentile":0.17432}],"risk":0.1295,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-25","epss":0.00259,"percentile":0.17432}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-25","epss":0.00241,"percentile":0.15048}],"risk":0.1205,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-25","epss":0.00241,"percentile":0.15048}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-25","epss":0.00241,"percentile":0.15048}],"risk":0.1205,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-25","epss":0.00241,"percentile":0.15048}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-25","epss":0.00219,"percentile":0.12255}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-25","epss":0.00219,"percentile":0.12255}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-25","epss":0.00219,"percentile":0.12255}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-25","epss":0.00219,"percentile":0.12255}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-25","epss":0.00207,"percentile":0.10736}],"risk":0.1035,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-25","epss":0.00207,"percentile":0.10736}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-25","epss":0.00207,"percentile":0.10736}],"risk":0.1035,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-25","epss":0.00207,"percentile":0.10736}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-25","epss":0.00201,"percentile":0.09822}],"risk":0.1005,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-25","epss":0.00201,"percentile":0.09822}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-25","epss":0.00201,"percentile":0.09822}],"risk":0.1005,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-25","epss":0.00201,"percentile":0.09822}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56109","versionConstraint":"< 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56109","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56109","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56109","date":"2026-10-25","epss":0.00138,"percentile":0.03173}],"risk":0.09935999999999999,"urls":["https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0","https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1","https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56109","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-25","epss":0.00197,"percentile":0.09333}],"risk":0.0985,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-25","epss":0.00197,"percentile":0.09333}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-25","epss":0.00197,"percentile":0.09333}],"risk":0.0985,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-25","epss":0.00197,"percentile":0.09333}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-25","epss":0.00195,"percentile":0.09121}],"risk":0.09749999999999999,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-25","epss":0.00195,"percentile":0.09121}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-25","epss":0.00195,"percentile":0.09121}],"risk":0.09749999999999999,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-25","epss":0.00195,"percentile":0.09121}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-25","epss":0.00182,"percentile":0.07708}],"risk":0.091,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-25","epss":0.00182,"percentile":0.07708}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-25","epss":0.00182,"percentile":0.07708}],"risk":0.091,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-25","epss":0.00182,"percentile":0.07708}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-25","epss":0.00179,"percentile":0.0739}],"risk":0.0895,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-25","epss":0.00179,"percentile":0.0739}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-25","epss":0.00179,"percentile":0.0739}],"risk":0.0895,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-25","epss":0.00179,"percentile":0.0739}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"d4ab3efc304a4e30","cpes":["cpe:2.3:a:openjdk21:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk21:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*"],"name":"openjdk21","purl":"pkg:apk/alpine/openjdk21@21.0.12_p8-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"21.0.12_p8-r0","language":"","licenses":["GPL-2.0-with-classpath-exception"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/jvm"},{"path":"/usr/lib/jvm/java-21-openjdk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openjdk21"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-60589","versionConstraint":"< 1.8.0_504||>= 1.9, < 8.0.504||>= 12, < 17.0.20.1||>= 18, < 21.0.12.1||>= 22, < 25.0.4.1||>= 26, < 26.0.2.1||>= 9, < 11.0.32.1 (jvm)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.12_p8:*:*:*:*:*:*:*"],"package":{"name":"openjdk21","version":"21.0.12_p8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-60589","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60589","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60589","date":"2026-10-25","epss":0.00265,"percentile":0.18249}],"risk":0.08877499999999999,"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60589","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-25","epss":0.00172,"percentile":0.0656}],"risk":0.086,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-25","epss":0.00172,"percentile":0.0656}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-25","epss":0.00172,"percentile":0.0656}],"risk":0.086,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-25","epss":0.00172,"percentile":0.0656}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-90781","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-90781","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90781","cwe":"CWE-193","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-90781","date":"2026-10-25","epss":0.00179,"percentile":0.07421}],"risk":0.08592,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c#L216-L241","https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020","https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-off-by-one-stack-buffer-overflow-in-snd-ctl-ascii-elem-id-parse"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90781","description":"alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process."},"relatedVulnerabilities":[]},{"artifact":{"id":"db0be20435ff9026","cpes":["cpe:2.3:a:gnu:tar:1.35-r5:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:1.35-r5:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:apk/alpine/tar@1.35-r5?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.35-r5","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/tar"},{"path":"/usr"},{"path":"/usr/libexec"},{"path":"/usr/libexec/rmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tar"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-18508","versionConstraint":"= 1.35 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*"],"package":{"name":"tar","version":"1.35-r5"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-18508","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18508","date":"2026-10-25","epss":0.00141,"percentile":0.03388}],"risk":0.06627,"urls":["https://access.redhat.com/errata/RHSA-2026:50807","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18508","https://bugzilla.redhat.com/show_bug.cgi?id=2509843"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-25","epss":0.00126,"percentile":0.02255}],"risk":0.063,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-25","epss":0.00126,"percentile":0.02255}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-25","epss":0.00126,"percentile":0.02255}],"risk":0.063,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-25","epss":0.00126,"percentile":0.02255}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96674","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96674","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96674","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96674","date":"2026-10-25","epss":0.00115,"percentile":0.01548}],"risk":0.0552,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1316-L1326","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1420-L1430","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1511-L1521","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-integer-overflow-via-topology-file"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96674","description":"alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application."},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96675","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96675","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96675","date":"2026-10-25","epss":0.00111,"percentile":0.01302}],"risk":0.05022750000000001,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/pcm/pcm_multi.c#L1122-L1131","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-denial-of-service-via-pcm-multi"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96675","description":"alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort."},"relatedVulnerabilities":[]},{"artifact":{"id":"db0be20435ff9026","cpes":["cpe:2.3:a:gnu:tar:1.35-r5:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:1.35-r5:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:apk/alpine/tar@1.35-r5?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.35-r5","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/tar"},{"path":"/usr"},{"path":"/usr/libexec"},{"path":"/usr/libexec/rmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:ff825015e04d4c7d1b2ec47c8cd0617753eb581bf1e8d139801f1d23b843ce0a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tar"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-18477","versionConstraint":"= 1.35 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*"],"package":{"name":"tar","version":"1.35-r5"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-18477","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18477","date":"2026-10-25","epss":0.0008,"percentile":0.00153}],"risk":0.0376,"urls":["https://access.redhat.com/errata/RHSA-2026:49361","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18477","https://bugzilla.redhat.com/show_bug.cgi?id=2509735"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue."},"relatedVulnerabilities":[]}],"grade":"A","score":"90.00","as_of":"2026-10-26T10:07:56.530Z","grype_db_version":"2026-10-26T06:38:44.000Z"}