{"grype_matches":[{"artifact":{"id":"fdbc1f25fefe97ba","cpes":["cpe:2.3:a:grafana:loki\\/v3:v3.0.0-20261015143358-c969f5cf4b4c:*:*:*:*:*:*:*"],"name":"github.com/grafana/loki/v3","purl":"pkg:golang/github.com/grafana/loki/v3@v3.0.0-20261015143358-c969f5cf4b4c","type":"go-module","version":"v3.0.0-20261015143358-c969f5cf4b4c","language":"go","licenses":[],"metadata":{"mainModule":"github.com/grafana/loki/v3","architecture":"amd64","goBuildSettings":[{"key":"-buildmode","value":"exe"},{"key":"-compiler","value":"gc"},{"key":"-ldflags","value":"-extldflags \"-static\" -s -w -X github.com/grafana/loki/v3/pkg/util/build.Branch=release-3.6.x -X github.com/grafana/loki/v3/pkg/util/build.Version=3.6.18 -X github.com/grafana/loki/v3/pkg/util/build.Revision=c969f5cf -X github.com/grafana/loki/v3/pkg/util/build.BuildUser=root@buildkitsandbox -X github.com/grafana/loki/v3/pkg/util/build.BuildDate=2026-10-15T16:36:48Z"},{"key":"-tags","value":"netgo"},{"key":"CGO_ENABLED","value":"0"},{"key":"GOARCH","value":"amd64"},{"key":"GOOS","value":"linux"},{"key":"GOAMD64","value":"v1"},{"key":"vcs","value":"git"},{"key":"vcs.revision","value":"c969f5cf4b4ca6073d29e0a74b236f4d05d7b79a"},{"key":"vcs.time","value":"2026-10-15T14:33:58Z"},{"key":"vcs.modified","value":"false"}],"goCompiledVersion":"go1.26.9"},"locations":[{"path":"/usr/bin/loki","layerID":"sha256:aa5daf0b61fff42bc2384c1cf84dc83a4d07113e443e1d36d25ebaf36dcc2c5f","accessPath":"/usr/bin/loki","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.6.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-497x-rrr9-68jp","versionConstraint":"<3.6.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/grafana/loki/v3","version":"v3.0.0-20261015143358-c969f5cf4b4c"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-497x-rrr9-68jp","fix":{"state":"fixed","versions":["3.6.4"],"available":[{"date":"2026-04-17","kind":"first-observed","version":"3.6.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21726","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21726","date":"2026-10-17","epss":0.00409,"percentile":0.33685}],"risk":0.210635,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-21726","https://grafana.com/security/security-advisories/cve-2026-21726"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-497x-rrr9-68jp","description":"Grafana Loki Path Traversal - CVE-2021-36156 Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-21726","cvss":[{"type":"Secondary","source":"security@grafana.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21726","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21726","date":"2026-10-17","epss":0.00409,"percentile":0.33685}],"urls":["https://grafana.com/security/security-advisories/cve-2026-21726"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21726","description":"The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}\n\nThanks to Prasanth Sundararajan for reporting this vulnerability."}]},{"artifact":{"id":"a62fe12685c39955","cpes":["cpe:2.3:a:golang:crypto:v0.57.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.57.0:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.57.0","type":"go-module","version":"v0.57.0","language":"go","licenses":[],"metadata":{"mainModule":"github.com/grafana/loki/v3","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/usr/bin/loki","layerID":"sha256:aa5daf0b61fff42bc2384c1cf84dc83a4d07113e443e1d36d25ebaf36dcc2c5f","accessPath":"/usr/bin/loki","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"none (unknown)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.57.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5932","fix":{"state":"","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/44226","description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package."},"relatedVulnerabilities":[]}],"grade":"A","score":"100.00","as_of":"2026-10-19T04:15:58.519Z","grype_db_version":"2026-10-18T06:27:17.000Z"}