{"grype_matches":[{"artifact":{"id":"bf291b3ff1f0a486","cpes":["cpe:2.3:a:git:git:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A2.25.1-1ubuntu3.14?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1:2.25.1-1ubuntu3.14","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-48384","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git","version":"1:2.25.1-1ubuntu3.14"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-48384","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-48384","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-48384","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-48384","date":"2026-10-28","epss":0.04379,"percentile":0.9125}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-48384","knownExploited":[{"cve":"CVE-2025-48384","cwes":["CWE-59","CWE-436"],"urls":["https://access.redhat.com/errata/RHSA-2025:13933","https://alas.aws.amazon.com/AL2/ALAS2-2025-2941.html","https://linux.oracle.com/errata/ELSA-2025-11534.html","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384","https://nvd.nist.gov/vuln/detail/CVE-2025-48384"],"notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","dueDate":"2025-09-15","product":"Git","dateAdded":"2025-08-25","vendorProject":"Git","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2025-48384","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48384","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-48384","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-48384","date":"2026-10-28","epss":0.04379,"percentile":0.9125}],"urls":["https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","http://seclists.org/fulldisclosure/2025/Sep/60","http://www.openwall.com/lists/oss-security/2025/07/08/4","https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48384","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","knownExploited":[{"cve":"CVE-2025-48384","cwes":["CWE-59","CWE-436"],"urls":["https://access.redhat.com/errata/RHSA-2025:13933","https://alas.aws.amazon.com/AL2/ALAS2-2025-2941.html","https://linux.oracle.com/errata/ELSA-2025-11534.html","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384","https://nvd.nist.gov/vuln/detail/CVE-2025-48384"],"notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","dueDate":"2025-09-15","product":"Git","dateAdded":"2025-08-25","vendorProject":"Git","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"160f2ca74a1211ed","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A2.25.1-1ubuntu3.14?arch=all&distro=ubuntu-20.04&upstream=git","type":"deb","version":"1:2.25.1-1ubuntu3.14","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-48384","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git","version":"1:2.25.1-1ubuntu3.14"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-48384","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-48384","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-48384","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-48384","date":"2026-10-28","epss":0.04379,"percentile":0.9125}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-48384","knownExploited":[{"cve":"CVE-2025-48384","cwes":["CWE-59","CWE-436"],"urls":["https://access.redhat.com/errata/RHSA-2025:13933","https://alas.aws.amazon.com/AL2/ALAS2-2025-2941.html","https://linux.oracle.com/errata/ELSA-2025-11534.html","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384","https://nvd.nist.gov/vuln/detail/CVE-2025-48384"],"notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","dueDate":"2025-09-15","product":"Git","dateAdded":"2025-08-25","vendorProject":"Git","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2025-48384","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48384","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-48384","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-48384","date":"2026-10-28","epss":0.04379,"percentile":0.9125}],"urls":["https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","http://seclists.org/fulldisclosure/2025/Sep/60","http://www.openwall.com/lists/oss-security/2025/07/08/4","https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48384","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","knownExploited":[{"cve":"CVE-2025-48384","cwes":["CWE-59","CWE-436"],"urls":["https://access.redhat.com/errata/RHSA-2025:13933","https://alas.aws.amazon.com/AL2/ALAS2-2025-2941.html","https://linux.oracle.com/errata/ELSA-2025-11534.html","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384","https://nvd.nist.gov/vuln/detail/CVE-2025-48384"],"notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","dueDate":"2025-09-15","product":"Git","dateAdded":"2025-08-25","vendorProject":"Git","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2687","versionConstraint":"<1.21.9||>=1.22.0-0,<1.22.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2687","fix":{"state":"fixed","versions":["1.21.9","1.22.2"],"available":[{"date":"2024-04-03","kind":"release","version":"1.21.9"},{"date":"2024-04-03","kind":"release","version":"1.22.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-28","epss":0.91969,"percentile":0.99818}],"risk":68.97675,"urls":["https://go.dev/cl/576155","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/65051","description":"An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.\n\nMaintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed.\n\nThis permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send.\n\nThe fix sets a limit on the amount of excess header frames we will process before closing a connection."},"relatedVulnerabilities":[{"id":"CVE-2023-45288","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-28","epss":0.91969,"percentile":0.99818}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/03/16","http://www.openwall.com/lists/oss-security/2024/04/05/4","https://go.dev/cl/576155","https://go.dev/issue/65051","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/","https://pkg.go.dev/vuln/GO-2024-2687","https://security.netapp.com/advisory/ntap-20240419-0009/","https://www.kb.cert.org/vuls/id/421644"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45288","description":"An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection."},{"id":"GHSA-4v7x-pqxf-cx7m","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-28","epss":0.91969,"percentile":0.99818}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-45288","https://go.dev/cl/576155","https://go.dev/issue/65051","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M","https://pkg.go.dev/vuln/GO-2024-2687","https://nowotarski.info/http2-continuation-flood-technical-details","https://security.netapp.com/advisory/ntap-20240419-0009","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT","http://www.openwall.com/lists/oss-security/2024/04/03/16","http://www.openwall.com/lists/oss-security/2024/04/05/4","https://www.kb.cert.org/vuls/id/421644"],"severity":"Medium","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-4v7x-pqxf-cx7m","description":"net/http, x/net/http2: close connections when receiving too many headers"}]},{"artifact":{"id":"aa67b442ba19fe87","cpes":["cpe:2.3:a:libbrotli1:libbrotli1:1.0.7-6ubuntu0.1:*:*:*:*:*:*:*"],"name":"libbrotli1","purl":"pkg:deb/ubuntu/libbrotli1@1.0.7-6ubuntu0.1?arch=amd64&distro=ubuntu-20.04&upstream=brotli","type":"deb","version":"1.0.7-6ubuntu0.1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbrotli1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libbrotli1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbrotli1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libbrotli1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"brotli"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"brotli","version":"1.0.7-6ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-111497","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-10-28","epss":0.87988,"percentile":0.99763}],"risk":52.5,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-111497","knownExploited":[{"cve":"CVE-2026-111497","cwes":["CWE-252","CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-111497"],"notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-10","product":"Brotli","dateAdded":"2026-10-27","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-111497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-10-28","epss":0.87988,"percentile":0.99763}],"urls":["https://github.com/andybalholm/brotli/releases/tag/v1.2.7","https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","http://www.openwall.com/lists/oss-security/2026/10/23/25","http://www.openwall.com/lists/oss-security/2026/10/24/6","http://www.openwall.com/lists/oss-security/2026/10/26/12","http://www.openwall.com/lists/oss-security/2026/10/26/13","http://www.openwall.com/lists/oss-security/2026/10/26/16","https://broccoli2shell.com","https://github.com/advisories/GHSA-9v8h-qqgm-4m35","https://github.com/dotnet/announcements/issues/494","https://github.com/google/brotli/releases/tag/v1.0.10","https://github.com/google/brotli/releases/tag/v1.1.1","https://github.com/google/brotli/releases/tag/v1.2.1","https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html","https://patchtheplanet.org/brotli","https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","knownExploited":[{"cve":"CVE-2026-111497","cwes":["CWE-252","CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-111497"],"notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-10","product":"Brotli","dateAdded":"2026-10-27","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"eb449e619430b2d7","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.31.1-4ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.31.1-4ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.31.1-4ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.31.1-4ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.31.1-4ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.31.1-4ubuntu0.7:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.31.1-4ubuntu0.7?arch=amd64&distro=ubuntu-20.04&upstream=sqlite3","type":"deb","version":"3.31.1-4ubuntu0.7","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"sqlite3","version":"3.31.1-4ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6965","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6965","cwe":"CWE-197","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-6965","date":"2026-10-28","epss":0.73452,"percentile":0.99463}],"risk":36.726,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6965"},"relatedVulnerabilities":[{"id":"CVE-2025-6965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L","metrics":{"baseScore":7.7,"impactScore":5.3,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Green","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6965","cwe":"CWE-197","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-6965","date":"2026-10-28","epss":0.73452,"percentile":0.99463}],"urls":["https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8","http://seclists.org/fulldisclosure/2025/Sep/49","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/56","http://seclists.org/fulldisclosure/2025/Sep/57","http://seclists.org/fulldisclosure/2025/Sep/58","http://www.openwall.com/lists/oss-security/2025/09/06/1","https://cert-portal.siemens.com/productcert/html/ssa-225816.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-765416.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6965","description":"There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-28","epss":0.27095,"percentile":0.98042}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-28","epss":0.27095,"percentile":0.98042}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-28","epss":0.27095,"percentile":0.98042}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-28","epss":0.27095,"percentile":0.98042}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-28","epss":0.27095,"percentile":0.98042}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-28","epss":0.27095,"percentile":0.98042}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-28","epss":0.27095,"percentile":0.98042}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-28","epss":0.27095,"percentile":0.98042}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-28","epss":0.40736,"percentile":0.98649}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-28","epss":0.40736,"percentile":0.98649}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-28","epss":0.40736,"percentile":0.98649}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-28","epss":0.40736,"percentile":0.98649}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-28","epss":0.40736,"percentile":0.98649}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-28","epss":0.40736,"percentile":0.98649}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-28","epss":0.40736,"percentile":0.98649}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-28","epss":0.40736,"percentile":0.98649}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"12308dd4ba29a3f4","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A8.2p1-4ubuntu0.13?arch=amd64&distro=ubuntu-20.04&upstream=openssh","type":"deb","version":"1:8.2p1-4ubuntu0.13","language":"","licenses":["BSD-2-clause","BSD-3-clause","Beer-ware","Expat-with-advertising-restriction","Mazieres-BSD-style","OpenSSH","Powell-BSD-style","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.preinst"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6110","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssh","version":"1:8.2p1-4ubuntu0.13"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-6110","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6110","date":"2026-10-28","epss":0.24901,"percentile":0.97903}],"risk":7.470300000000001,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6110"},"relatedVulnerabilities":[{"id":"CVE-2019-6110","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6110","date":"2026-10-28","epss":0.24901,"percentile":0.97903}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c","https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","https://security.gentoo.org/glsa/201903-16","https://security.netapp.com/advisory/ntap-20190213-0001/","https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","https://www.exploit-db.com/exploits/46193/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-412672.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6110","description":"In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred."}]},{"artifact":{"id":"12308dd4ba29a3f4","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A8.2p1-4ubuntu0.13?arch=amd64&distro=ubuntu-20.04&upstream=openssh","type":"deb","version":"1:8.2p1-4ubuntu0.13","language":"","licenses":["BSD-2-clause","BSD-3-clause","Beer-ware","Expat-with-advertising-restriction","Mazieres-BSD-style","OpenSSH","Powell-BSD-style","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.preinst"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-15778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssh","version":"1:8.2p1-4ubuntu0.13"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2020-15778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-15778","date":"2026-10-28","epss":0.13675,"percentile":0.96476}],"risk":4.1025,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-15778"},"relatedVulnerabilities":[{"id":"CVE-2020-15778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-15778","date":"2026-10-28","epss":0.13675,"percentile":0.96476}],"urls":["https://access.redhat.com/errata/RHSA-2024:3166","https://github.com/cpandya2909/CVE-2020-15778/","https://news.ycombinator.com/item?id=25005567","https://security.gentoo.org/glsa/202212-06","https://security.netapp.com/advisory/ntap-20200731-0007/","https://www.openssh.com/security.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15778","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\""}]},{"artifact":{"id":"8e935978aea981c0","cpes":["cpe:2.3:a:sudo:sudo:1.8.31-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"sudo","purl":"pkg:deb/ubuntu/sudo@1.8.31-1ubuntu1.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.8.31-1ubuntu1.5","language":"","licenses":["BSD-3-Clause","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/sudo/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/sudo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/sudo.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/sudo.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/sudo.list"},{"path":"/var/lib/dpkg/info/sudo.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/sudo.postinst"},{"path":"/var/lib/dpkg/info/sudo.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/sudo.postrm"},{"path":"/var/lib/dpkg/info/sudo.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/sudo.preinst"},{"path":"/var/lib/dpkg/info/sudo.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/sudo.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-32462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"sudo","version":"1.8.31-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-32462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-32462","cwe":"CWE-863","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-32462","date":"2026-10-28","epss":0.04477,"percentile":0.91425}],"risk":3.35775,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32462"},"relatedVulnerabilities":[{"id":"CVE-2025-32462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":6.1,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32462","cwe":"CWE-863","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-32462","date":"2026-10-28","epss":0.04477,"percentile":0.91425}],"urls":["https://access.redhat.com/security/cve/cve-2025-32462","https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32462","https://explore.alas.aws.amazon.com/CVE-2025-32462.html","https://lists.debian.org/debian-security-announce/2025/msg00118.html","https://security-tracker.debian.org/tracker/CVE-2025-32462","https://ubuntu.com/security/notices/USN-7604-1","https://www.openwall.com/lists/oss-security/2025/06/30/2","https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host","https://www.sudo.ws/releases/changelog/","https://www.sudo.ws/security/advisories/","https://www.sudo.ws/security/advisories/host_any/","https://www.suse.com/security/cve/CVE-2025-32462.html","https://lists.debian.org/debian-lts-announce/2025/06/msg00033.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32462","description":"Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-10-28","epss":0.04002,"percentile":0.90497}],"risk":3.0015,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45447"},"relatedVulnerabilities":[{"id":"CVE-2026-45447","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-10-28","epss":0.04002,"percentile":0.90497}],"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-10-28","epss":0.04002,"percentile":0.90497}],"risk":3.0015,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45447"},"relatedVulnerabilities":[{"id":"CVE-2026-45447","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-10-28","epss":0.04002,"percentile":0.90497}],"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.20.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-2102","versionConstraint":"<1.20.10||>=1.21.0-0,<1.21.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-2102","fix":{"state":"fixed","versions":["1.20.10","1.21.3"],"available":[{"date":"2023-10-10","kind":"release","version":"1.20.10"},{"date":"2023-10-10","kind":"release","version":"1.21.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-28","epss":0.03796,"percentile":0.89952}],"risk":2.8470000000000004,"urls":["https://go.dev/cl/534215","https://go.dev/cl/534235","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/63417","description":"A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing.\n\nWith the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection.\n\nThis issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2.\n\nThe default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function."},"relatedVulnerabilities":[{"id":"CVE-2023-39325","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-28","epss":0.03796,"percentile":0.89952}],"urls":["https://go.dev/cl/534215","https://go.dev/cl/534235","https://go.dev/issue/63417","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/","https://pkg.go.dev/vuln/GO-2023-2102","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231110-0008/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39325","description":"A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function."},{"id":"GHSA-4374-p667-p6c8","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-28","epss":0.03796,"percentile":0.89952}],"urls":["https://github.com/golang/go/issues/63417","https://go.dev/cl/534215","https://go.dev/cl/534235","https://go.dev/issue/63417","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ","https://nvd.nist.gov/vuln/detail/CVE-2023-39325","https://pkg.go.dev/vuln/GO-2023-2102","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV","https://security.netapp.com/advisory/ntap-20231110-0008","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-4374-p667-p6c8","description":"HTTP/2 rapid reset can cause excessive work in net/http"}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.20.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-2185","versionConstraint":"<1.20.11||>=1.21.0-0,<1.21.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-2185","fix":{"state":"fixed","versions":["1.20.11","1.21.4"],"available":[{"date":"2023-11-07","kind":"release","version":"1.20.11"},{"date":"2023-11-07","kind":"release","version":"1.21.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45283","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-45283","date":"2026-10-28","epss":0.02758,"percentile":0.86205}],"risk":2.0685000000000002,"urls":["https://go.dev/cl/540277","https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY","https://go.dev/issue/64028","https://go.dev/cl/541175","https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/63713","description":"The filepath package does not recognize paths with a \\??\\ prefix as special.\n\nOn Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x.\n\nBefore fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b.\n\nSimilarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b.\n\nIn addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name.\n\nUPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored."},"relatedVulnerabilities":[{"id":"CVE-2023-45283","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45283","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-45283","date":"2026-10-28","epss":0.02758,"percentile":0.86205}],"urls":["http://www.openwall.com/lists/oss-security/2023/12/05/2","https://go.dev/cl/540277","https://go.dev/cl/541175","https://go.dev/issue/63713","https://go.dev/issue/64028","https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY","https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ","https://pkg.go.dev/vuln/GO-2023-2185","https://security.netapp.com/advisory/ntap-20231214-0008/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45283","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2887","versionConstraint":"<1.21.11||>=1.22.0-0,<1.22.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2887","fix":{"state":"fixed","versions":["1.21.11","1.22.4"],"available":[{"date":"2024-06-04","kind":"release","version":"1.21.11"},{"date":"2024-06-04","kind":"release","version":"1.22.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24790","date":"2026-10-28","epss":0.01952,"percentile":0.80169}],"risk":1.8348800000000003,"urls":["https://go.dev/issue/67680","https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/590316","description":"The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms."},"relatedVulnerabilities":[{"id":"CVE-2024-24790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24790","date":"2026-10-28","epss":0.01952,"percentile":0.80169}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/04/1","https://go.dev/cl/590316","https://go.dev/issue/67680","https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ","https://pkg.go.dev/vuln/GO-2024-2887","https://security.netapp.com/advisory/ntap-20240905-0002/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-24790","description":"The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4341","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4341","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-61726","date":"2026-10-28","epss":0.02292,"percentile":0.8317}],"risk":1.719,"urls":["https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/736712","description":"The net/url package does not set a limit on the number of query parameters in a query.\n\nWhile the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61726","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-61726","date":"2026-10-28","epss":0.02292,"percentile":0.8317}],"urls":["https://go.dev/cl/736712","https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4341","https://access.redhat.com/errata/RHSA-2026:10096","https://access.redhat.com/errata/RHSA-2026:10104","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:11408","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:15984","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17446","https://access.redhat.com/errata/RHSA-2026:17460","https://access.redhat.com/errata/RHSA-2026:17463","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17595","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:18913","https://access.redhat.com/errata/RHSA-2026:19013","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:2681","https://access.redhat.com/errata/RHSA-2026:2706","https://access.redhat.com/errata/RHSA-2026:2708","https://access.redhat.com/errata/RHSA-2026:2709","https://access.redhat.com/errata/RHSA-2026:2754","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:2914","https://access.redhat.com/errata/RHSA-2026:2920","https://access.redhat.com/errata/RHSA-2026:3035","https://access.redhat.com/errata/RHSA-2026:3040","https://access.redhat.com/errata/RHSA-2026:3089","https://access.redhat.com/errata/RHSA-2026:3092","https://access.redhat.com/errata/RHSA-2026:3184","https://access.redhat.com/errata/RHSA-2026:3186","https://access.redhat.com/errata/RHSA-2026:3187","https://access.redhat.com/errata/RHSA-2026:3188","https://access.redhat.com/errata/RHSA-2026:3192","https://access.redhat.com/errata/RHSA-2026:3193","https://access.redhat.com/errata/RHSA-2026:3291","https://access.redhat.com/errata/RHSA-2026:3296","https://access.redhat.com/errata/RHSA-2026:3297","https://access.redhat.com/errata/RHSA-2026:3298","https://access.redhat.com/errata/RHSA-2026:3336","https://access.redhat.com/errata/RHSA-2026:3337","https://access.redhat.com/errata/RHSA-2026:3340","https://access.redhat.com/errata/RHSA-2026:3341","https://access.redhat.com/errata/RHSA-2026:3343","https://access.redhat.com/errata/RHSA-2026:3391","https://access.redhat.com/errata/RHSA-2026:3416","https://access.redhat.com/errata/RHSA-2026:3427","https://access.redhat.com/errata/RHSA-2026:3459","https://access.redhat.com/errata/RHSA-2026:3468","https://access.redhat.com/errata/RHSA-2026:3469","https://access.redhat.com/errata/RHSA-2026:3470","https://access.redhat.com/errata/RHSA-2026:3471","https://access.redhat.com/errata/RHSA-2026:3472","https://access.redhat.com/errata/RHSA-2026:3473","https://access.redhat.com/errata/RHSA-2026:3489","https://access.redhat.com/errata/RHSA-2026:3506","https://access.redhat.com/errata/RHSA-2026:3556","https://access.redhat.com/errata/RHSA-2026:3559","https://access.redhat.com/errata/RHSA-2026:3668","https://access.redhat.com/errata/RHSA-2026:3669","https://access.redhat.com/errata/RHSA-2026:36873","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3699","https://access.redhat.com/errata/RHSA-2026:3713","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:3752","https://access.redhat.com/errata/RHSA-2026:3753","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3812","https://access.redhat.com/errata/RHSA-2026:3813","https://access.redhat.com/errata/RHSA-2026:3814","https://access.redhat.com/errata/RHSA-2026:3815","https://access.redhat.com/errata/RHSA-2026:3816","https://access.redhat.com/errata/RHSA-2026:3817","https://access.redhat.com/errata/RHSA-2026:3818","https://access.redhat.com/errata/RHSA-2026:3820","https://access.redhat.com/errata/RHSA-2026:3821","https://access.redhat.com/errata/RHSA-2026:3822","https://access.redhat.com/errata/RHSA-2026:3831","https://access.redhat.com/errata/RHSA-2026:3833","https://access.redhat.com/errata/RHSA-2026:3835","https://access.redhat.com/errata/RHSA-2026:3836","https://access.redhat.com/errata/RHSA-2026:3838","https://access.redhat.com/errata/RHSA-2026:3839","https://access.redhat.com/errata/RHSA-2026:3840","https://access.redhat.com/errata/RHSA-2026:3841","https://access.redhat.com/errata/RHSA-2026:3843","https://access.redhat.com/errata/RHSA-2026:3854","https://access.redhat.com/errata/RHSA-2026:3855","https://access.redhat.com/errata/RHSA-2026:3856","https://access.redhat.com/errata/RHSA-2026:3864","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3875","https://access.redhat.com/errata/RHSA-2026:3879","https://access.redhat.com/errata/RHSA-2026:3880","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3898","https://access.redhat.com/errata/RHSA-2026:3905","https://access.redhat.com/errata/RHSA-2026:3906","https://access.redhat.com/errata/RHSA-2026:3928","https://access.redhat.com/errata/RHSA-2026:3929","https://access.redhat.com/errata/RHSA-2026:3930","https://access.redhat.com/errata/RHSA-2026:3931","https://access.redhat.com/errata/RHSA-2026:3932","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3959","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3970","https://access.redhat.com/errata/RHSA-2026:3971","https://access.redhat.com/errata/RHSA-2026:3972","https://access.redhat.com/errata/RHSA-2026:3973","https://access.redhat.com/errata/RHSA-2026:3974","https://access.redhat.com/errata/RHSA-2026:3977","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:3985","https://access.redhat.com/errata/RHSA-2026:40924","https://access.redhat.com/errata/RHSA-2026:4164","https://access.redhat.com/errata/RHSA-2026:4166","https://access.redhat.com/errata/RHSA-2026:4170","https://access.redhat.com/errata/RHSA-2026:4174","https://access.redhat.com/errata/RHSA-2026:4177","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:4211","https://access.redhat.com/errata/RHSA-2026:4220","https://access.redhat.com/errata/RHSA-2026:4256","https://access.redhat.com/errata/RHSA-2026:4264","https://access.redhat.com/errata/RHSA-2026:4267","https://access.redhat.com/errata/RHSA-2026:4270","https://access.redhat.com/errata/RHSA-2026:4276","https://access.redhat.com/errata/RHSA-2026:4434","https://access.redhat.com/errata/RHSA-2026:4435","https://access.redhat.com/errata/RHSA-2026:4460","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4498","https://access.redhat.com/errata/RHSA-2026:4500","https://access.redhat.com/errata/RHSA-2026:4510","https://access.redhat.com/errata/RHSA-2026:4511","https://access.redhat.com/errata/RHSA-2026:4672","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:4753","https://access.redhat.com/errata/RHSA-2026:4892","https://access.redhat.com/errata/RHSA-2026:4901","https://access.redhat.com/errata/RHSA-2026:4907","https://access.redhat.com/errata/RHSA-2026:4939","https://access.redhat.com/errata/RHSA-2026:4942","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:4952","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5022","https://access.redhat.com/errata/RHSA-2026:5030","https://access.redhat.com/errata/RHSA-2026:5031","https://access.redhat.com/errata/RHSA-2026:5076","https://access.redhat.com/errata/RHSA-2026:5077","https://access.redhat.com/errata/RHSA-2026:5078","https://access.redhat.com/errata/RHSA-2026:5079","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:5129","https://access.redhat.com/errata/RHSA-2026:5130","https://access.redhat.com/errata/RHSA-2026:5131","https://access.redhat.com/errata/RHSA-2026:5132","https://access.redhat.com/errata/RHSA-2026:5145","https://access.redhat.com/errata/RHSA-2026:5146","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5327","https://access.redhat.com/errata/RHSA-2026:5394","https://access.redhat.com/errata/RHSA-2026:5439","https://access.redhat.com/errata/RHSA-2026:5444","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:5452","https://access.redhat.com/errata/RHSA-2026:5461","https://access.redhat.com/errata/RHSA-2026:5463","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5533","https://access.redhat.com/errata/RHSA-2026:5544","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:5645","https://access.redhat.com/errata/RHSA-2026:5649","https://access.redhat.com/errata/RHSA-2026:5665","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5851","https://access.redhat.com/errata/RHSA-2026:5852","https://access.redhat.com/errata/RHSA-2026:5853","https://access.redhat.com/errata/RHSA-2026:5948","https://access.redhat.com/errata/RHSA-2026:5950","https://access.redhat.com/errata/RHSA-2026:5952","https://access.redhat.com/errata/RHSA-2026:5968","https://access.redhat.com/errata/RHSA-2026:6184","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6226","https://access.redhat.com/errata/RHSA-2026:6251","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6278","https://access.redhat.com/errata/RHSA-2026:6428","https://access.redhat.com/errata/RHSA-2026:6429","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6554","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:7052","https://access.redhat.com/errata/RHSA-2026:7249","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7676","https://access.redhat.com/errata/RHSA-2026:7854","https://access.redhat.com/errata/RHSA-2026:7942","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8431","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-61726","https://bugzilla.redhat.com/show_bug.cgi?id=2434432","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61726","description":"The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5026","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5026","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39821","date":"2026-10-28","epss":0.01834,"percentile":0.7883}],"risk":1.4396899999999997,"urls":["https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/767220","description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\"."},"relatedVulnerabilities":[{"id":"CVE-2026-39821","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"impactScore":5.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39821","date":"2026-10-28","epss":0.01834,"percentile":0.7883}],"urls":["https://go.dev/cl/767220","https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5026","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:30853","https://access.redhat.com/errata/RHSA-2026:30854","https://access.redhat.com/errata/RHSA-2026:30855","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34789","https://access.redhat.com/errata/RHSA-2026:35826","https://access.redhat.com/errata/RHSA-2026:35827","https://access.redhat.com/errata/RHSA-2026:35828","https://access.redhat.com/errata/RHSA-2026:35829","https://access.redhat.com/errata/RHSA-2026:35830","https://access.redhat.com/errata/RHSA-2026:35831","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37435","https://access.redhat.com/errata/RHSA-2026:37436","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:44624","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:52826","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54580","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56143","https://access.redhat.com/errata/RHSA-2026:56223","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57541","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59546","https://access.redhat.com/errata/RHSA-2026:59549","https://access.redhat.com/errata/RHSA-2026:59562","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62549","https://access.redhat.com/errata/RHSA-2026:63134","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65359","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/errata/RHSA-2026:66432","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67159","https://access.redhat.com/errata/RHSA-2026:67160","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/security/cve/CVE-2026-39821","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\"."}]},{"artifact":{"id":"12308dd4ba29a3f4","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A8.2p1-4ubuntu0.13?arch=amd64&distro=ubuntu-20.04&upstream=openssh","type":"deb","version":"1:8.2p1-4ubuntu0.13","language":"","licenses":["BSD-2-clause","BSD-3-clause","Beer-ware","Expat-with-advertising-restriction","Mazieres-BSD-style","OpenSSH","Powell-BSD-style","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.preinst"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssh","version":"1:8.2p1-4ubuntu0.13"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3497","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3497","cwe":"CWE-908","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-3497","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-3497","date":"2026-10-28","epss":0.02219,"percentile":0.82602}],"risk":1.1095000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3497"},"relatedVulnerabilities":[{"id":"CVE-2026-3497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3497","cwe":"CWE-908","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-3497","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-3497","date":"2026-10-28","epss":0.02219,"percentile":0.82602}],"urls":["https://ubuntu.com/security/CVE-2026-3497","https://www.openwall.com/lists/oss-security/2026/03/12/3","http://www.openwall.com/lists/oss-security/2026/03/12/3","http://www.openwall.com/lists/oss-security/2026/03/14/3","http://www.openwall.com/lists/oss-security/2026/03/14/4","http://www.openwall.com/lists/oss-security/2026/03/18/2","http://www.openwall.com/lists/oss-security/2026/03/18/4","http://www.openwall.com/lists/oss-security/2026/03/18/5","http://www.openwall.com/lists/oss-security/2026/03/18/7","https://lists.debian.org/debian-lts-announce/2026/04/msg00014.html","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:10714","https://access.redhat.com/errata/RHSA-2026:12071","https://access.redhat.com/errata/RHSA-2026:13750","https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:14773","https://access.redhat.com/errata/RHSA-2026:14924","https://access.redhat.com/errata/RHSA-2026:15087","https://access.redhat.com/errata/RHSA-2026:15891","https://access.redhat.com/errata/RHSA-2026:15893","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16030","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17596","https://access.redhat.com/errata/RHSA-2026:19724","https://access.redhat.com/errata/RHSA-2026:19725","https://access.redhat.com/errata/RHSA-2026:20040","https://access.redhat.com/errata/RHSA-2026:20087","https://access.redhat.com/errata/RHSA-2026:21690","https://access.redhat.com/errata/RHSA-2026:21695","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:5475","https://access.redhat.com/errata/RHSA-2026:6461","https://access.redhat.com/errata/RHSA-2026:6462","https://access.redhat.com/errata/RHSA-2026:6463","https://access.redhat.com/errata/RHSA-2026:7107","https://access.redhat.com/errata/RHSA-2026:9415","https://access.redhat.com/errata/RHSA-2026:9732","https://access.redhat.com/security/cve/CVE-2026-3497","https://bugzilla.redhat.com/show_bug.cgi?id=2447085","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3497.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3497","description":"Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration."}]},{"artifact":{"id":"198ee162877e76c2","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.9-1ubuntu0.8:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.2.9-1ubuntu0.8?arch=amd64&distro=ubuntu-20.04&upstream=expat","type":"deb","version":"2.2.9-1ubuntu0.8","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52425","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"expat","version":"2.2.9-1ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-52425","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52425","date":"2026-10-28","epss":0.02149,"percentile":0.82053}],"risk":1.0745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52425"},"relatedVulnerabilities":[{"id":"CVE-2023-52425","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52425","date":"2026-10-28","epss":0.02149,"percentile":0.82053}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/20/5","https://github.com/libexpat/libexpat/pull/789","https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/","https://security.netapp.com/advisory/ntap-20240614-0003/","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52425","description":"libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed."}]},{"artifact":{"id":"12308dd4ba29a3f4","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A8.2p1-4ubuntu0.13?arch=amd64&distro=ubuntu-20.04&upstream=openssh","type":"deb","version":"1:8.2p1-4ubuntu0.13","language":"","licenses":["BSD-2-clause","BSD-3-clause","Beer-ware","Expat-with-advertising-restriction","Mazieres-BSD-style","OpenSSH","Powell-BSD-style","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.preinst"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssh","version":"1:8.2p1-4ubuntu0.13"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2018-15919","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-15919","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15919","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15919","date":"2026-10-28","epss":0.03557,"percentile":0.89282}],"risk":1.0670999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-15919"},"relatedVulnerabilities":[{"id":"CVE-2018-15919","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15919","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15919","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15919","date":"2026-10-28","epss":0.03557,"percentile":0.89282}],"urls":["http://seclists.org/oss-sec/2018/q3/180","http://www.securityfocus.com/bid/105163","https://security.netapp.com/advisory/ntap-20181221-0001/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15919","description":"Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or \"oracle\") as a vulnerability.'"}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2963","versionConstraint":"<1.21.12||>=1.22.0-0,<1.22.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2963","fix":{"state":"fixed","versions":["1.21.12","1.22.5"],"available":[{"date":"2024-07-02","kind":"release","version":"1.21.12"},{"date":"2024-07-02","kind":"release","version":"1.22.5"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24791","date":"2026-10-28","epss":0.01414,"percentile":0.72633}],"risk":1.0605,"urls":["https://go.dev/issue/67555","https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/591255","description":"The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an \"Expect: 100-continue\" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail.\n\nAn attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending \"Expect: 100-continue\" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail."},"relatedVulnerabilities":[{"id":"CVE-2024-24791","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24791","date":"2026-10-28","epss":0.01414,"percentile":0.72633}],"urls":["https://go.dev/cl/591255","https://go.dev/issue/67555","https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ","https://pkg.go.dev/vuln/GO-2024-2963","https://security.netapp.com/advisory/ntap-20241004-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-24791","description":"The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an \"Expect: 100-continue\" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending \"Expect: 100-continue\" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail."}]},{"artifact":{"id":"9ad028a9a47a9fb7","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33574","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2021-33574","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-28","epss":0.03522,"percentile":0.8919}],"risk":1.0566,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-33574"},"relatedVulnerabilities":[{"id":"CVE-2021-33574","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-28","epss":0.03522,"percentile":0.8919}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210629-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=27896","https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-831302.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."}]},{"artifact":{"id":"c4143394e9032e2d","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33574","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2021-33574","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-28","epss":0.03522,"percentile":0.8919}],"risk":1.0566,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-33574"},"relatedVulnerabilities":[{"id":"CVE-2021-33574","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-28","epss":0.03522,"percentile":0.8919}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210629-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=27896","https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-831302.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."}]},{"artifact":{"id":"8cb74e3775c9e438","cpes":["cpe:2.3:a:locales:locales:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.31-0ubuntu9.18?arch=all&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33574","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2021-33574","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-28","epss":0.03522,"percentile":0.8919}],"risk":1.0566,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-33574"},"relatedVulnerabilities":[{"id":"CVE-2021-33574","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-28","epss":0.03522,"percentile":0.8919}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210629-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=27896","https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-831302.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33845","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-33845","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33845","date":"2026-10-28","epss":0.02073,"percentile":0.81384}],"risk":1.0365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33845"},"relatedVulnerabilities":[{"id":"CVE-2026-33845","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33845","date":"2026-10-28","epss":0.02073,"percentile":0.81384}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34372","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-33845","https://bugzilla.redhat.com/show_bug.cgi?id=2450624","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33845","description":"A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service."}]},{"artifact":{"id":"198ee162877e76c2","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.9-1ubuntu0.8:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.2.9-1ubuntu0.8?arch=amd64&distro=ubuntu-20.04&upstream=expat","type":"deb","version":"2.2.9-1ubuntu0.8","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"expat","version":"2.2.9-1ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2024-28757","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28757","date":"2026-10-28","epss":0.02006,"percentile":0.80746}],"risk":1.0030000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-28757"},"relatedVulnerabilities":[{"id":"CVE-2024-28757","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-28757","cwe":"CWE-776","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28757","date":"2026-10-28","epss":0.02006,"percentile":0.80746}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/15/1","https://github.com/libexpat/libexpat/issues/839","https://github.com/libexpat/libexpat/pull/842","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/","https://security.netapp.com/advisory/ntap-20240322-0001/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28757","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate)."}]},{"artifact":{"id":"9ad028a9a47a9fb7","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-28","epss":0.03249,"percentile":0.88282}],"risk":0.9746999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010022"},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-28","epss":0.03249,"percentile":0.88282}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"c4143394e9032e2d","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-28","epss":0.03249,"percentile":0.88282}],"risk":0.9746999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010022"},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-28","epss":0.03249,"percentile":0.88282}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"8cb74e3775c9e438","cpes":["cpe:2.3:a:locales:locales:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.31-0ubuntu9.18?arch=all&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-28","epss":0.03249,"percentile":0.88282}],"risk":0.9746999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010022"},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-28","epss":0.03249,"percentile":0.88282}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"9ad028a9a47a9fb7","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-28","epss":0.0322,"percentile":0.88176}],"risk":0.966,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010024"},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-28","epss":0.0322,"percentile":0.88176}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"c4143394e9032e2d","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-28","epss":0.0322,"percentile":0.88176}],"risk":0.966,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010024"},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-28","epss":0.0322,"percentile":0.88176}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"8cb74e3775c9e438","cpes":["cpe:2.3:a:locales:locales:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.31-0ubuntu9.18?arch=all&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-28","epss":0.0322,"percentile":0.88176}],"risk":0.966,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010024"},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-28","epss":0.0322,"percentile":0.88176}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"bfe6694a44340acd","cpes":["cpe:2.3:a:libssh-4:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh-4:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*"],"name":"libssh-4","purl":"pkg:deb/ubuntu/libssh-4@0.9.3-2ubuntu2.5?arch=amd64&distro=ubuntu-20.04&upstream=libssh","type":"deb","version":"0.9.3-2ubuntu2.5","language":"","licenses":["BSD-2-clause","BSD-3-clause","LGPL-2.1","LGPL-2.1+~OpenSSL","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh-4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssh-4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libssh","version":"0.9.3-2ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-5318","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-5318","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5318","date":"2026-10-28","epss":0.01886,"percentile":0.79426}],"risk":0.943,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-5318"},"relatedVulnerabilities":[{"id":"CVE-2025-5318","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5318","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5318","date":"2026-10-28","epss":0.01886,"percentile":0.79426}],"urls":["https://access.redhat.com/errata/RHSA-2025:18231","https://access.redhat.com/errata/RHSA-2025:18275","https://access.redhat.com/errata/RHSA-2025:18286","https://access.redhat.com/errata/RHSA-2025:19012","https://access.redhat.com/errata/RHSA-2025:19098","https://access.redhat.com/errata/RHSA-2025:19101","https://access.redhat.com/errata/RHSA-2025:19295","https://access.redhat.com/errata/RHSA-2025:19300","https://access.redhat.com/errata/RHSA-2025:19313","https://access.redhat.com/errata/RHSA-2025:19400","https://access.redhat.com/errata/RHSA-2025:19401","https://access.redhat.com/errata/RHSA-2025:19470","https://access.redhat.com/errata/RHSA-2025:19472","https://access.redhat.com/errata/RHSA-2025:19807","https://access.redhat.com/errata/RHSA-2025:19864","https://access.redhat.com/errata/RHSA-2025:20943","https://access.redhat.com/errata/RHSA-2025:21013","https://access.redhat.com/errata/RHSA-2025:21329","https://access.redhat.com/errata/RHSA-2025:21829","https://access.redhat.com/errata/RHSA-2025:22275","https://access.redhat.com/errata/RHSA-2025:23078","https://access.redhat.com/errata/RHSA-2025:23079","https://access.redhat.com/errata/RHSA-2025:23080","https://access.redhat.com/errata/RHSA-2026:0326","https://access.redhat.com/errata/RHSA-2026:1541","https://access.redhat.com/errata/RHSA-2026:3461","https://access.redhat.com/errata/RHSA-2026:3462","https://access.redhat.com/security/cve/CVE-2025-5318","https://bugzilla.redhat.com/show_bug.cgi?id=2369131","https://www.libssh.org/security/advisories/CVE-2025-5318.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5318","description":"A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior."}]},{"artifact":{"id":"9ad028a9a47a9fb7","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-28","epss":0.03069,"percentile":0.87593}],"risk":0.9207,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010023"},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-28","epss":0.03069,"percentile":0.87593}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"c4143394e9032e2d","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-28","epss":0.03069,"percentile":0.87593}],"risk":0.9207,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010023"},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-28","epss":0.03069,"percentile":0.87593}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"8cb74e3775c9e438","cpes":["cpe:2.3:a:locales:locales:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.31-0ubuntu9.18?arch=all&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-28","epss":0.03069,"percentile":0.87593}],"risk":0.9207,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010023"},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-28","epss":0.03069,"percentile":0.87593}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-10-28","epss":0.01742,"percentile":0.77671}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-10-28","epss":0.01742,"percentile":0.77671}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-10-28","epss":0.01742,"percentile":0.77671}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-10-28","epss":0.01742,"percentile":0.77671}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-10-28","epss":0.01742,"percentile":0.77671}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-10-28","epss":0.01742,"percentile":0.77671}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-10-28","epss":0.01742,"percentile":0.77671}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-10-28","epss":0.01742,"percentile":0.77671}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4337","versionConstraint":"<1.24.13||>=1.25.0-0,<1.25.7||>=1.26.0-rc.1,<1.26.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4337","fix":{"state":"fixed","versions":["1.24.13","1.25.7","1.26.0-rc.3"],"available":[{"date":"2026-02-04","kind":"release","version":"1.24.13"},{"date":"2026-02-04","kind":"release","version":"1.25.7"},{"date":"2026-02-04","kind":"release","version":"1.26.0-rc.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68121","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-68121","date":"2026-10-28","epss":0.00915,"percentile":0.60022}],"risk":0.8692500000000001,"urls":["https://go.dev/cl/737700","https://go.dev/issue/77217"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","description":"During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake."},"relatedVulnerabilities":[{"id":"CVE-2025-68121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68121","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-68121","date":"2026-10-28","epss":0.00915,"percentile":0.60022}],"urls":["https://go.dev/cl/737700","https://go.dev/issue/77217","https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","https://pkg.go.dev/vuln/GO-2026-4337"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68121","description":"During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake."}]},{"artifact":{"id":"99b6ce94877a50b1","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/ubuntu/libtasn1-6@4.16.0-2ubuntu0.1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"4.16.0-2ubuntu0.1","language":"","licenses":["sha256:ab2f3532a1bf45d90643e92c1dfb985982698ecbf63f12595acfd9598d36350d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-46848","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libtasn1-6","version":"4.16.0-2ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2021-46848","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-46848","date":"2026-10-28","epss":0.02823,"percentile":0.86537}],"risk":0.8469000000000001,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-46848"},"relatedVulnerabilities":[{"id":"CVE-2021-46848","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-46848","date":"2026-10-28","epss":0.02823,"percentile":0.86537}],"urls":["https://bugs.gentoo.org/866237","https://gitlab.com/gnutls/libtasn1/-/commit/44a700d2051a666235748970c2df047ff207aeb5","https://gitlab.com/gnutls/libtasn1/-/issues/32","https://lists.debian.org/debian-lts-announce/2023/01/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV4SHDJF2XLB4CUPTBPQQ6CLGZ5LKXPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECM2ELTVRYV4BZ5L5GMIRQE27RFHPAQ6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGO7XST4EIJGX4B2ITZCYSWM24534BSU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V5LWOGF7QRMNFRUCZY6TDYQJVFI6MOQ2/","https://security.netapp.com/advisory/ntap-20221118-0006/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46848","description":"GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-3106","versionConstraint":"<1.22.7||>=1.23.0-0,<1.23.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-3106","fix":{"state":"fixed","versions":["1.22.7","1.23.1"],"available":[{"date":"2024-09-05","kind":"release","version":"1.22.7"},{"date":"2024-09-05","kind":"release","version":"1.23.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-34156","date":"2026-10-28","epss":0.01127,"percentile":0.66217}],"risk":0.84525,"urls":["https://go.dev/issue/69139","https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/611239","description":"Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635."},"relatedVulnerabilities":[{"id":"CVE-2024-34156","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-34156","date":"2026-10-28","epss":0.01127,"percentile":0.66217}],"urls":["https://go.dev/cl/611239","https://go.dev/issue/69139","https://groups.google.com/g/golang-dev/c/S9POB9NCTdk","https://pkg.go.dev/vuln/GO-2024-3106","https://security.netapp.com/advisory/ntap-20240926-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-34156","description":"Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13836","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-10-28","epss":0.01631,"percentile":0.76141}],"risk":0.8155000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13836"},"relatedVulnerabilities":[{"id":"CVE-2025-13836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-10-28","epss":0.01631,"percentile":0.76141}],"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13836","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-10-28","epss":0.01631,"percentile":0.76141}],"risk":0.8155000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13836"},"relatedVulnerabilities":[{"id":"CVE-2025-13836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-10-28","epss":0.01631,"percentile":0.76141}],"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-13836","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-10-28","epss":0.01631,"percentile":0.76141}],"risk":0.8155000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13836"},"relatedVulnerabilities":[{"id":"CVE-2025-13836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-10-28","epss":0.01631,"percentile":0.76141}],"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13836","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-10-28","epss":0.01631,"percentile":0.76141}],"risk":0.8155000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13836"},"relatedVulnerabilities":[{"id":"CVE-2025-13836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-10-28","epss":0.01631,"percentile":0.76141}],"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2609","versionConstraint":"<1.21.8||>=1.22.0-0,<1.22.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2609","fix":{"state":"fixed","versions":["1.21.8","1.22.1"],"available":[{"date":"2024-03-05","kind":"release","version":"1.21.8"},{"date":"2024-03-05","kind":"release","version":"1.22.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24784","date":"2026-10-28","epss":0.0105,"percentile":0.64158}],"risk":0.7875,"urls":["https://go.dev/cl/555596","https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/65083","description":"The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers."},"relatedVulnerabilities":[{"id":"CVE-2024-24784","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24784","date":"2026-10-28","epss":0.0105,"percentile":0.64158}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/08/4","https://go.dev/cl/555596","https://go.dev/issue/65083","https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg","https://pkg.go.dev/vuln/GO-2024-2609","https://security.netapp.com/advisory/ntap-20240329-0007/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-24784","description":"The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-3107","versionConstraint":"<1.22.7||>=1.23.0-0,<1.23.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-3107","fix":{"state":"fixed","versions":["1.22.7","1.23.1"],"available":[{"date":"2024-09-05","kind":"release","version":"1.22.7"},{"date":"2024-09-05","kind":"release","version":"1.23.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34158","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-34158","date":"2026-10-28","epss":0.01046,"percentile":0.64063}],"risk":0.7845000000000001,"urls":["https://go.dev/issue/69141","https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/611240","description":"Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2024-34158","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-34158","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-34158","date":"2026-10-28","epss":0.01046,"percentile":0.64063}],"urls":["https://go.dev/cl/611240","https://go.dev/issue/69141","https://groups.google.com/g/golang-dev/c/S9POB9NCTdk","https://pkg.go.dev/vuln/GO-2024-3107","https://security.netapp.com/advisory/ntap-20241004-0003/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-34158","description":"Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-9230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-10-28","epss":0.01554,"percentile":0.75059}],"risk":0.777,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9230"},"relatedVulnerabilities":[{"id":"CVE-2025-9230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-10-28","epss":0.01554,"percentile":0.75059}],"urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-9230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-9230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-10-28","epss":0.01554,"percentile":0.75059}],"risk":0.777,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9230"},"relatedVulnerabilities":[{"id":"CVE-2025-9230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-10-28","epss":0.01554,"percentile":0.75059}],"urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-3563","versionConstraint":"<1.23.8||>=1.24.0-0,<1.24.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-3563","fix":{"state":"fixed","versions":["1.23.8","1.24.2"],"available":[{"date":"2025-04-01","kind":"release","version":"1.23.8"},{"date":"2025-04-01","kind":"release","version":"1.24.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-22871","date":"2026-10-28","epss":0.00826,"percentile":0.57285}],"risk":0.74753,"urls":["https://go.dev/issue/71988","https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/652998","description":"The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext."},"relatedVulnerabilities":[{"id":"CVE-2025-22871","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-22871","date":"2026-10-28","epss":0.00826,"percentile":0.57285}],"urls":["https://go.dev/cl/652998","https://go.dev/issue/71988","https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk","https://pkg.go.dev/vuln/GO-2025-3563","http://www.openwall.com/lists/oss-security/2025/04/04/4","https://cert-portal.siemens.com/productcert/html/ssa-783943.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22871","description":"The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-32988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-32988","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-32988","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32988","date":"2026-10-28","epss":0.01475,"percentile":0.73733}],"risk":0.7374999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32988"},"relatedVulnerabilities":[{"id":"CVE-2025-32988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32988","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32988","date":"2026-10-28","epss":0.01475,"percentile":0.73733}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:17415","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/errata/RHSA-2026:7477","https://access.redhat.com/security/cve/CVE-2025-32988","https://bugzilla.redhat.com/show_bug.cgi?id=2359622","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32988","description":"A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.\n\nThis vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior."}]},{"artifact":{"id":"198ee162877e76c2","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.9-1ubuntu0.8:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.2.9-1ubuntu0.8?arch=amd64&distro=ubuntu-20.04&upstream=expat","type":"deb","version":"2.2.9-1ubuntu0.8","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-59375","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"expat","version":"2.2.9-1ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-59375","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-59375","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-59375","date":"2026-10-28","epss":0.0138,"percentile":0.72017}],"risk":0.69,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-59375"},"relatedVulnerabilities":[{"id":"CVE-2025-59375","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59375","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-59375","date":"2026-10-28","epss":0.0138,"percentile":0.72017}],"urls":["https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74","https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes","https://github.com/libexpat/libexpat/issues/1018","https://github.com/libexpat/libexpat/pull/1034","https://issues.oss-fuzz.com/issues/439133977","http://www.openwall.com/lists/oss-security/2025/09/16/2","http://www.openwall.com/lists/oss-security/2026/05/01/5","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59375","description":"libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing."}]},{"artifact":{"id":"99b6ce94877a50b1","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/ubuntu/libtasn1-6@4.16.0-2ubuntu0.1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"4.16.0-2ubuntu0.1","language":"","licenses":["sha256:ab2f3532a1bf45d90643e92c1dfb985982698ecbf63f12595acfd9598d36350d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-13151","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libtasn1-6","version":"4.16.0-2ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-13151","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13151","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-13151","date":"2026-10-28","epss":0.0137,"percentile":0.71806}],"risk":0.685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13151"},"relatedVulnerabilities":[{"id":"CVE-2025-13151","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13151","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-13151","date":"2026-10-28","epss":0.0137,"percentile":0.71806}],"urls":["https://gitlab.com/gnutls/libtasn1","https://gitlab.com/gnutls/libtasn1/-/merge_requests/121","http://www.openwall.com/lists/oss-security/2026/01/08/5","https://www.kb.cert.org/vuls/id/271649"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13151","description":"Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28417","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28417","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28417","cwe":"CWE-86","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28417","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-28417","date":"2026-10-28","epss":0.01353,"percentile":0.71477}],"risk":0.6765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28417"},"relatedVulnerabilities":[{"id":"CVE-2026-28417","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28417","cwe":"CWE-86","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28417","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-28417","date":"2026-10-28","epss":0.01353,"percentile":0.71477}],"urls":["https://github.com/vim/vim/commit/79348dbbc09332130f4c860","https://github.com/vim/vim/releases/tag/v9.2.0073","https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336","http://www.openwall.com/lists/oss-security/2026/02/27/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28417","description":"Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28417","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28417","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28417","cwe":"CWE-86","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28417","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-28417","date":"2026-10-28","epss":0.01353,"percentile":0.71477}],"risk":0.6765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28417"},"relatedVulnerabilities":[{"id":"CVE-2026-28417","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28417","cwe":"CWE-86","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28417","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-28417","date":"2026-10-28","epss":0.01353,"percentile":0.71477}],"urls":["https://github.com/vim/vim/commit/79348dbbc09332130f4c860","https://github.com/vim/vim/releases/tag/v9.2.0073","https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336","http://www.openwall.com/lists/oss-security/2026/02/27/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28417","description":"Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28417","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28417","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28417","cwe":"CWE-86","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28417","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-28417","date":"2026-10-28","epss":0.01353,"percentile":0.71477}],"risk":0.6765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28417"},"relatedVulnerabilities":[{"id":"CVE-2026-28417","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28417","cwe":"CWE-86","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28417","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-28417","date":"2026-10-28","epss":0.01353,"percentile":0.71477}],"urls":["https://github.com/vim/vim/commit/79348dbbc09332130f4c860","https://github.com/vim/vim/releases/tag/v9.2.0073","https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336","http://www.openwall.com/lists/oss-security/2026/02/27/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28417","description":"Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue."}]},{"artifact":{"id":"198ee162877e76c2","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.9-1ubuntu0.8:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.2.9-1ubuntu0.8?arch=amd64&distro=ubuntu-20.04&upstream=expat","type":"deb","version":"2.2.9-1ubuntu0.8","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"expat","version":"2.2.9-1ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2024-8176","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-8176","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-8176","date":"2026-10-28","epss":0.01353,"percentile":0.71462}],"risk":0.6765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8176"},"relatedVulnerabilities":[{"id":"CVE-2024-8176","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8176","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-8176","date":"2026-10-28","epss":0.01353,"percentile":0.71462}],"urls":["https://access.redhat.com/errata/RHSA-2025:13681","https://access.redhat.com/errata/RHSA-2025:22033","https://access.redhat.com/errata/RHSA-2025:22034","https://access.redhat.com/errata/RHSA-2025:22035","https://access.redhat.com/errata/RHSA-2025:22607","https://access.redhat.com/errata/RHSA-2025:22785","https://access.redhat.com/errata/RHSA-2025:22842","https://access.redhat.com/errata/RHSA-2025:22871","https://access.redhat.com/errata/RHSA-2025:3531","https://access.redhat.com/errata/RHSA-2025:3734","https://access.redhat.com/errata/RHSA-2025:3913","https://access.redhat.com/errata/RHSA-2025:4048","https://access.redhat.com/errata/RHSA-2025:4446","https://access.redhat.com/errata/RHSA-2025:4447","https://access.redhat.com/errata/RHSA-2025:4448","https://access.redhat.com/errata/RHSA-2025:4449","https://access.redhat.com/errata/RHSA-2025:7444","https://access.redhat.com/errata/RHSA-2025:7512","https://access.redhat.com/errata/RHSA-2025:8385","https://access.redhat.com/security/cve/CVE-2024-8176","https://bugzilla.redhat.com/show_bug.cgi?id=2310137","https://github.com/libexpat/libexpat/issues/893","https://github.com/libexpat/libexpat/pull/973","http://seclists.org/fulldisclosure/2025/May/10","http://seclists.org/fulldisclosure/2025/May/11","http://seclists.org/fulldisclosure/2025/May/12","http://seclists.org/fulldisclosure/2025/May/6","http://seclists.org/fulldisclosure/2025/May/7","http://seclists.org/fulldisclosure/2025/May/8","http://www.openwall.com/lists/oss-security/2025/03/15/1","http://www.openwall.com/lists/oss-security/2025/09/24/11","https://blog.hartwork.org/posts/expat-2-7-0-released/","https://bugzilla.suse.com/show_bug.cgi?id=1239618","https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40-L52","https://gitlab.alpinelinux.org/alpine/aports/-/commit/d068c3ff36fc6f4789988a09c69b434db757db53","https://security-tracker.debian.org/tracker/CVE-2024-8176","https://security.netapp.com/advisory/ntap-20250328-0009/","https://ubuntu.com/security/CVE-2024-8176","https://www.kb.cert.org/vuls/id/760160","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8176","description":"A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2599","versionConstraint":"<1.21.8||>=1.22.0-0,<1.22.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2599","fix":{"state":"fixed","versions":["1.21.8","1.22.1"],"available":[{"date":"2024-03-05","kind":"release","version":"1.21.8"},{"date":"2024-03-05","kind":"release","version":"1.22.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45290","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45290","date":"2026-10-28","epss":0.01165,"percentile":0.67199}],"risk":0.669875,"urls":["https://go.dev/cl/569341","https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/65383","description":"When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion.\n\nWith fix, the ParseMultipartForm function now correctly limits the maximum size of form lines."},"relatedVulnerabilities":[{"id":"CVE-2023-45290","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45290","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45290","date":"2026-10-28","epss":0.01165,"percentile":0.67199}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/08/4","https://go.dev/cl/569341","https://go.dev/issue/65383","https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg","https://pkg.go.dev/vuln/GO-2024-2599","https://security.netapp.com/advisory/ntap-20240329-0004/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45290","description":"When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42009","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42009","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42009","date":"2026-10-28","epss":0.01335,"percentile":0.71063}],"risk":0.6675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42009"},"relatedVulnerabilities":[{"id":"CVE-2026-42009","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42009","date":"2026-10-28","epss":0.01335,"percentile":0.71063}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29794","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34372","https://access.redhat.com/errata/RHSA-2026:34764","https://access.redhat.com/errata/RHSA-2026:34788","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42009","https://bugzilla.redhat.com/show_bug.cgi?id=2467279","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42009","description":"A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4981","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4981","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33811","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33811","cwe":"CWE-1341","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33811","date":"2026-10-28","epss":0.00875,"percentile":0.58833}],"risk":0.6562500000000001,"urls":["https://go.dev/cl/767860","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78803","description":"When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash."},"relatedVulnerabilities":[{"id":"CVE-2026-33811","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33811","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33811","cwe":"CWE-1341","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33811","date":"2026-10-28","epss":0.00875,"percentile":0.58833}],"urls":["https://go.dev/cl/767860","https://go.dev/issue/78803","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4981","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:35832","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:35995","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36617","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36776","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:38504","https://access.redhat.com/errata/RHSA-2026:39266","https://access.redhat.com/errata/RHSA-2026:39272","https://access.redhat.com/errata/RHSA-2026:39319","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:42946","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49703","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54168","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54500","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54556","https://access.redhat.com/errata/RHSA-2026:54584","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56790","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56855","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56913","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60302","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:61313","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/security/cve/CVE-2026-33811","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","description":"When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash."}]},{"artifact":{"id":"5e3f99daab9a1514","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:245.4-4ubuntu3.24:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/ubuntu/libsystemd0@245.4-4ubuntu3.24?arch=amd64&distro=ubuntu-20.04&upstream=systemd","type":"deb","version":"245.4-4ubuntu3.24","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4598","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"systemd","version":"245.4-4ubuntu3.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-4598","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-10-28","epss":0.01277,"percentile":0.69855}],"risk":0.6385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4598"},"relatedVulnerabilities":[{"id":"CVE-2025-4598","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-10-28","epss":0.01277,"percentile":0.69855}],"urls":["https://access.redhat.com/errata/RHSA-2025:22660","https://access.redhat.com/errata/RHSA-2025:22868","https://access.redhat.com/errata/RHSA-2025:23227","https://access.redhat.com/errata/RHSA-2025:23234","https://access.redhat.com/errata/RHSA-2026:0414","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:18153","https://access.redhat.com/security/cve/CVE-2025-4598","https://bugzilla.redhat.com/show_bug.cgi?id=2369242","https://www.openwall.com/lists/oss-security/2025/05/29/3","http://seclists.org/fulldisclosure/2025/Jun/9","http://www.openwall.com/lists/oss-security/2025/06/05/1","http://www.openwall.com/lists/oss-security/2025/06/05/3","http://www.openwall.com/lists/oss-security/2025/08/18/3","https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598","https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/","https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html","https://www.openwall.com/lists/oss-security/2025/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."}]},{"artifact":{"id":"7fb6e4c8e297c76a","cpes":["cpe:2.3:a:libudev1:libudev1:245.4-4ubuntu3.24:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@245.4-4ubuntu3.24?arch=amd64&distro=ubuntu-20.04&upstream=systemd","type":"deb","version":"245.4-4ubuntu3.24","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4598","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"systemd","version":"245.4-4ubuntu3.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-4598","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-10-28","epss":0.01277,"percentile":0.69855}],"risk":0.6385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4598"},"relatedVulnerabilities":[{"id":"CVE-2025-4598","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-10-28","epss":0.01277,"percentile":0.69855}],"urls":["https://access.redhat.com/errata/RHSA-2025:22660","https://access.redhat.com/errata/RHSA-2025:22868","https://access.redhat.com/errata/RHSA-2025:23227","https://access.redhat.com/errata/RHSA-2025:23234","https://access.redhat.com/errata/RHSA-2026:0414","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:18153","https://access.redhat.com/security/cve/CVE-2025-4598","https://bugzilla.redhat.com/show_bug.cgi?id=2369242","https://www.openwall.com/lists/oss-security/2025/05/29/3","http://seclists.org/fulldisclosure/2025/Jun/9","http://www.openwall.com/lists/oss-security/2025/06/05/1","http://www.openwall.com/lists/oss-security/2025/06/05/3","http://www.openwall.com/lists/oss-security/2025/08/18/3","https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598","https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/","https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html","https://www.openwall.com/lists/oss-security/2025/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33846","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-33846","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33846","date":"2026-10-28","epss":0.01263,"percentile":0.69589}],"risk":0.6315000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33846"},"relatedVulnerabilities":[{"id":"CVE-2026-33846","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33846","date":"2026-10-28","epss":0.01263,"percentile":0.69589}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34372","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-33846","https://bugzilla.redhat.com/show_bug.cgi?id=2450625","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33846","description":"A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4918","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4918","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33814","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33814","date":"2026-10-28","epss":0.0084,"percentile":0.57735}],"risk":0.63,"urls":["https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/761581","description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0."},"relatedVulnerabilities":[{"id":"CVE-2026-33814","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33814","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33814","date":"2026-10-28","epss":0.0084,"percentile":0.57735}],"urls":["https://go.dev/cl/761581","https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4918","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57367","https://access.redhat.com/errata/RHSA-2026:57408","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60441","https://access.redhat.com/errata/RHSA-2026:60442","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60447","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60478","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60668","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62410","https://access.redhat.com/errata/RHSA-2026:62550","https://access.redhat.com/errata/RHSA-2026:62551","https://access.redhat.com/errata/RHSA-2026:63046","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63048","https://access.redhat.com/errata/RHSA-2026:63050","https://access.redhat.com/errata/RHSA-2026:63091","https://access.redhat.com/errata/RHSA-2026:63096","https://access.redhat.com/errata/RHSA-2026:63097","https://access.redhat.com/errata/RHSA-2026:63103","https://access.redhat.com/errata/RHSA-2026:63104","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:63637","https://access.redhat.com/errata/RHSA-2026:63639","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/security/cve/CVE-2026-33814","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33814","description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-28","epss":0.00831,"percentile":0.57449}],"risk":0.62325,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84782"},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-28","epss":0.00831,"percentile":0.57449}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-28","epss":0.00831,"percentile":0.57449}],"risk":0.62325,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84782"},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-28","epss":0.00831,"percentile":0.57449}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.20.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-2382","versionConstraint":"<1.20.12||>=1.21.0-0,<1.21.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-2382","fix":{"state":"fixed","versions":["1.20.12","1.21.5"],"available":[{"date":"2023-12-05","kind":"release","version":"1.20.12"},{"date":"2023-12-05","kind":"release","version":"1.21.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-39326","date":"2026-10-28","epss":0.01208,"percentile":0.68263}],"risk":0.62212,"urls":["https://go.dev/cl/547335","https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/64433","description":"A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body.\n\nA malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request.\n\nChunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small."},"relatedVulnerabilities":[{"id":"CVE-2023-39326","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-39326","date":"2026-10-28","epss":0.01208,"percentile":0.68263}],"urls":["https://go.dev/cl/547335","https://go.dev/issue/64433","https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/","https://pkg.go.dev/vuln/GO-2023-2382"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39326","description":"A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4977","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4977","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42499","cwe":"CWE-1046","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42499","date":"2026-10-28","epss":0.00798,"percentile":0.56378}],"risk":0.5984999999999999,"urls":["https://go.dev/cl/771520","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78987","description":"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."},"relatedVulnerabilities":[{"id":"CVE-2026-42499","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42499","cwe":"CWE-1046","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42499","date":"2026-10-28","epss":0.00798,"percentile":0.56378}],"urls":["https://go.dev/cl/771520","https://go.dev/issue/78987","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4977","https://access.redhat.com/errata/RHSA-2026:17713","https://access.redhat.com/errata/RHSA-2026:17714","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:57914","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62406","https://access.redhat.com/errata/RHSA-2026:62407","https://access.redhat.com/errata/RHSA-2026:62753","https://access.redhat.com/errata/RHSA-2026:62754","https://access.redhat.com/errata/RHSA-2026:62803","https://access.redhat.com/errata/RHSA-2026:63022","https://access.redhat.com/errata/RHSA-2026:63163","https://access.redhat.com/errata/RHSA-2026:63332","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:64818","https://access.redhat.com/errata/RHSA-2026:65116","https://access.redhat.com/errata/RHSA-2026:65117","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65335","https://access.redhat.com/errata/RHSA-2026:65336","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:65895","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66327","https://access.redhat.com/errata/RHSA-2026:67148","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:67974","https://access.redhat.com/errata/RHSA-2026:67975","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:68527","https://access.redhat.com/security/cve/CVE-2026-42499","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","description":"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4986","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4986","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39820","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-39820","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39820","date":"2026-10-28","epss":0.00784,"percentile":0.55908}],"risk":0.588,"urls":["https://go.dev/cl/759940","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78566","description":"Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations."},"relatedVulnerabilities":[{"id":"CVE-2026-39820","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39820","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-39820","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39820","date":"2026-10-28","epss":0.00784,"percentile":0.55908}],"urls":["https://go.dev/cl/759940","https://go.dev/issue/78566","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4986","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54883","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57401","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:57914","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62406","https://access.redhat.com/errata/RHSA-2026:62407","https://access.redhat.com/errata/RHSA-2026:62753","https://access.redhat.com/errata/RHSA-2026:62754","https://access.redhat.com/errata/RHSA-2026:62803","https://access.redhat.com/errata/RHSA-2026:63022","https://access.redhat.com/errata/RHSA-2026:65116","https://access.redhat.com/errata/RHSA-2026:65117","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65335","https://access.redhat.com/errata/RHSA-2026:65336","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:65895","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66327","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:67974","https://access.redhat.com/errata/RHSA-2026:67975","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:68527","https://access.redhat.com/security/cve/CVE-2026-39820","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","description":"Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4601","versionConstraint":"<1.25.8||>=1.26.0-0,<1.26.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4601","fix":{"state":"fixed","versions":["1.25.8","1.26.1"],"available":[{"date":"2026-03-06","kind":"release","version":"1.25.8"},{"date":"2026-03-06","kind":"release","version":"1.26.1"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25679","cwe":"CWE-425","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-25679","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25679","date":"2026-10-28","epss":0.00774,"percentile":0.55595}],"risk":0.5805,"urls":["https://go.dev/issue/77578","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/752180","description":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."},"relatedVulnerabilities":[{"id":"CVE-2026-25679","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25679","cwe":"CWE-425","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-25679","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25679","date":"2026-10-28","epss":0.00774,"percentile":0.55595}],"urls":["https://go.dev/cl/752180","https://go.dev/issue/77578","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://pkg.go.dev/vuln/GO-2026-4601","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:10125","https://access.redhat.com/errata/RHSA-2026:10133","https://access.redhat.com/errata/RHSA-2026:10140","https://access.redhat.com/errata/RHSA-2026:10141","https://access.redhat.com/errata/RHSA-2026:10158","https://access.redhat.com/errata/RHSA-2026:10169","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:10701","https://access.redhat.com/errata/RHSA-2026:10712","https://access.redhat.com/errata/RHSA-2026:10929","https://access.redhat.com/errata/RHSA-2026:11217","https://access.redhat.com/errata/RHSA-2026:11375","https://access.redhat.com/errata/RHSA-2026:11412","https://access.redhat.com/errata/RHSA-2026:11413","https://access.redhat.com/errata/RHSA-2026:11686","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:11800","https://access.redhat.com/errata/RHSA-2026:11856","https://access.redhat.com/errata/RHSA-2026:11916","https://access.redhat.com/errata/RHSA-2026:11996","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13508","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13642","https://access.redhat.com/errata/RHSA-2026:13643","https://access.redhat.com/errata/RHSA-2026:13671","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14020","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:19017","https://access.redhat.com/errata/RHSA-2026:19022","https://access.redhat.com/errata/RHSA-2026:19026","https://access.redhat.com/errata/RHSA-2026:19027","https://access.redhat.com/errata/RHSA-2026:19031","https://access.redhat.com/errata/RHSA-2026:19032","https://access.redhat.com/errata/RHSA-2026:19049","https://access.redhat.com/errata/RHSA-2026:19055","https://access.redhat.com/errata/RHSA-2026:19126","https://access.redhat.com/errata/RHSA-2026:19128","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19181","https://access.redhat.com/errata/RHSA-2026:19184","https://access.redhat.com/errata/RHSA-2026:19185","https://access.redhat.com/errata/RHSA-2026:19207","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19475","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:20581","https://access.redhat.com/errata/RHSA-2026:20582","https://access.redhat.com/errata/RHSA-2026:20584","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21655","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:21696","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22733","https://access.redhat.com/errata/RHSA-2026:22862","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24386","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:25043","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25180","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26445","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28893","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29702","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36317","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:52389","https://access.redhat.com/errata/RHSA-2026:52390","https://access.redhat.com/errata/RHSA-2026:52391","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:5941","https://access.redhat.com/errata/RHSA-2026:5942","https://access.redhat.com/errata/RHSA-2026:5943","https://access.redhat.com/errata/RHSA-2026:5944","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:6341","https://access.redhat.com/errata/RHSA-2026:6344","https://access.redhat.com/errata/RHSA-2026:6382","https://access.redhat.com/errata/RHSA-2026:6383","https://access.redhat.com/errata/RHSA-2026:6388","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:6720","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:6949","https://access.redhat.com/errata/RHSA-2026:7005","https://access.redhat.com/errata/RHSA-2026:7009","https://access.redhat.com/errata/RHSA-2026:7011","https://access.redhat.com/errata/RHSA-2026:7259","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7315","https://access.redhat.com/errata/RHSA-2026:7328","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7665","https://access.redhat.com/errata/RHSA-2026:7669","https://access.redhat.com/errata/RHSA-2026:7674","https://access.redhat.com/errata/RHSA-2026:7833","https://access.redhat.com/errata/RHSA-2026:7834","https://access.redhat.com/errata/RHSA-2026:7876","https://access.redhat.com/errata/RHSA-2026:7877","https://access.redhat.com/errata/RHSA-2026:7878","https://access.redhat.com/errata/RHSA-2026:7879","https://access.redhat.com/errata/RHSA-2026:7883","https://access.redhat.com/errata/RHSA-2026:7992","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8314","https://access.redhat.com/errata/RHSA-2026:8322","https://access.redhat.com/errata/RHSA-2026:8324","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8434","https://access.redhat.com/errata/RHSA-2026:8456","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8840","https://access.redhat.com/errata/RHSA-2026:8841","https://access.redhat.com/errata/RHSA-2026:8842","https://access.redhat.com/errata/RHSA-2026:8845","https://access.redhat.com/errata/RHSA-2026:8847","https://access.redhat.com/errata/RHSA-2026:8848","https://access.redhat.com/errata/RHSA-2026:8849","https://access.redhat.com/errata/RHSA-2026:8851","https://access.redhat.com/errata/RHSA-2026:8852","https://access.redhat.com/errata/RHSA-2026:8853","https://access.redhat.com/errata/RHSA-2026:8855","https://access.redhat.com/errata/RHSA-2026:8856","https://access.redhat.com/errata/RHSA-2026:8860","https://access.redhat.com/errata/RHSA-2026:8877","https://access.redhat.com/errata/RHSA-2026:8878","https://access.redhat.com/errata/RHSA-2026:8879","https://access.redhat.com/errata/RHSA-2026:8881","https://access.redhat.com/errata/RHSA-2026:8882","https://access.redhat.com/errata/RHSA-2026:8930","https://access.redhat.com/errata/RHSA-2026:8931","https://access.redhat.com/errata/RHSA-2026:8949","https://access.redhat.com/errata/RHSA-2026:9043","https://access.redhat.com/errata/RHSA-2026:9044","https://access.redhat.com/errata/RHSA-2026:9052","https://access.redhat.com/errata/RHSA-2026:9090","https://access.redhat.com/errata/RHSA-2026:9093","https://access.redhat.com/errata/RHSA-2026:9094","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9434","https://access.redhat.com/errata/RHSA-2026:9435","https://access.redhat.com/errata/RHSA-2026:9436","https://access.redhat.com/errata/RHSA-2026:9439","https://access.redhat.com/errata/RHSA-2026:9440","https://access.redhat.com/errata/RHSA-2026:9448","https://access.redhat.com/errata/RHSA-2026:9453","https://access.redhat.com/errata/RHSA-2026:9461","https://access.redhat.com/errata/RHSA-2026:9695","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/errata/RHSA-2026:9872","https://access.redhat.com/security/cve/CVE-2026-25679","https://bugzilla.redhat.com/show_bug.cgi?id=2445356","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","description":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6612","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78663","date":"2026-10-28","epss":0.00622,"percentile":0.49652}],"risk":0.56291,"urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847187","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."},"relatedVulnerabilities":[{"id":"CVE-2026-78663","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78663","date":"2026-10-28","epss":0.00622,"percentile":0.49652}],"urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."}]},{"artifact":{"id":"0173539095d733d0","cpes":["cpe:2.3:a:wget:wget:1.20.3-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/ubuntu/wget@1.20.3-1ubuntu2.1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.20.3-1ubuntu2.1","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-31879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"wget","version":"1.20.3-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2021-31879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-31879","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31879","date":"2026-10-28","epss":0.01104,"percentile":0.65642}],"risk":0.5519999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-31879"},"relatedVulnerabilities":[{"id":"CVE-2021-31879","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31879","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31879","date":"2026-10-28","epss":0.01104,"percentile":0.65642}],"urls":["https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html","https://security.netapp.com/advisory/ntap-20210618-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-31879","description":"GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007."}]},{"artifact":{"id":"06bb3b039ce73f06","cpes":["cpe:2.3:a:git-lfs:git-lfs:2.9.2-1:*:*:*:*:*:*:*","cpe:2.3:a:git-lfs:git_lfs:2.9.2-1:*:*:*:*:*:*:*","cpe:2.3:a:git_lfs:git-lfs:2.9.2-1:*:*:*:*:*:*:*","cpe:2.3:a:git_lfs:git_lfs:2.9.2-1:*:*:*:*:*:*:*","cpe:2.3:a:git:git-lfs:2.9.2-1:*:*:*:*:*:*:*","cpe:2.3:a:git:git_lfs:2.9.2-1:*:*:*:*:*:*:*"],"name":"git-lfs","purl":"pkg:deb/ubuntu/git-lfs@2.9.2-1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"2.9.2-1","language":"","licenses":["Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-lfs/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git-lfs/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-lfs.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-lfs.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-lfs.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-lfs.list"},{"path":"/var/lib/dpkg/info/git-lfs.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-lfs.postinst"},{"path":"/var/lib/dpkg/info/git-lfs.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-lfs.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-53263","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git-lfs","version":"2.9.2-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2024-53263","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-53263","cwe":"CWE-74","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-53263","date":"2026-10-28","epss":0.01063,"percentile":0.64497}],"risk":0.5315000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-53263"},"relatedVulnerabilities":[{"id":"CVE-2024-53263","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-53263","cwe":"CWE-74","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-53263","date":"2026-10-28","epss":0.01063,"percentile":0.64497}],"urls":["https://github.com/git-lfs/git-lfs/commit/0345b6f816e611d050c0df67b61f0022916a1c90","https://github.com/git-lfs/git-lfs/releases/tag/v3.6.1","https://github.com/git-lfs/git-lfs/security/advisories/GHSA-q6r2-x2cc-vrp7","https://lists.debian.org/debian-lts-announce/2025/01/msg00022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-53263","description":"Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time."}]},{"artifact":{"id":"06bb3b039ce73f06","cpes":["cpe:2.3:a:git-lfs:git-lfs:2.9.2-1:*:*:*:*:*:*:*","cpe:2.3:a:git-lfs:git_lfs:2.9.2-1:*:*:*:*:*:*:*","cpe:2.3:a:git_lfs:git-lfs:2.9.2-1:*:*:*:*:*:*:*","cpe:2.3:a:git_lfs:git_lfs:2.9.2-1:*:*:*:*:*:*:*","cpe:2.3:a:git:git-lfs:2.9.2-1:*:*:*:*:*:*:*","cpe:2.3:a:git:git_lfs:2.9.2-1:*:*:*:*:*:*:*"],"name":"git-lfs","purl":"pkg:deb/ubuntu/git-lfs@2.9.2-1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"2.9.2-1","language":"","licenses":["Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-lfs/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git-lfs/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-lfs.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-lfs.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-lfs.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-lfs.list"},{"path":"/var/lib/dpkg/info/git-lfs.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-lfs.postinst"},{"path":"/var/lib/dpkg/info/git-lfs.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-lfs.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-26625","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git-lfs","version":"2.9.2-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-26625","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-26625","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-26625","date":"2026-10-28","epss":0.01055,"percentile":0.64298}],"risk":0.5275,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-26625"},"relatedVulnerabilities":[{"id":"CVE-2025-26625","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-26625","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-26625","date":"2026-10-28","epss":0.01055,"percentile":0.64298}],"urls":["https://github.com/git-lfs/git-lfs/commit/0cffe93176b870055c9dadbb3cc9a4a440e98396","https://github.com/git-lfs/git-lfs/commit/5c11ffce9a4f095ff356bc781e2a031abb46c1a8","https://github.com/git-lfs/git-lfs/commit/d02bd13f02ef76f6807581cd6b34709069cb3615","https://github.com/git-lfs/git-lfs/releases/tag/v3.7.1","https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6pvw-g552-53c5","https://lists.debian.org/debian-lts-announce/2026/05/msg00055.html","https://lists.debian.org/debian-lts-announce/2026/10/msg00040.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-26625","description":"Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42010","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42010","cwe":"CWE-626","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42010","date":"2026-10-28","epss":0.0105,"percentile":0.6416}],"risk":0.525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42010"},"relatedVulnerabilities":[{"id":"CVE-2026-42010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42010","cwe":"CWE-626","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42010","date":"2026-10-28","epss":0.0105,"percentile":0.6416}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34764","https://access.redhat.com/errata/RHSA-2026:34788","https://access.redhat.com/errata/RHSA-2026:34790","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:62409","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:67857","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42010","https://bugzilla.redhat.com/show_bug.cgi?id=2467289","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42010","description":"A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6604","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6604","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56857","cwe":"CWE-1386","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56857","date":"2026-10-28","epss":0.00553,"percentile":0.46092}],"risk":0.5198200000000001,"urls":["https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847305","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."},"relatedVulnerabilities":[{"id":"CVE-2026-56857","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56857","cwe":"CWE-1386","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56857","date":"2026-10-28","epss":0.00553,"percentile":0.46092}],"urls":["https://go.dev/cl/847305","https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6604"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.20.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-2041","versionConstraint":"<1.20.8||>=1.21.0-0,<1.21.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-2041","fix":{"state":"fixed","versions":["1.20.8","1.21.1"],"available":[{"date":"2023-09-06","kind":"release","version":"1.20.8"},{"date":"2023-09-06","kind":"release","version":"1.21.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39318","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39318","date":"2026-10-28","epss":0.0093,"percentile":0.60468}],"risk":0.5161499999999999,"urls":["https://go.dev/cl/526156","https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/62196","description":"The html/template package does not properly handle HTML-like \"\" comment tokens, nor hashbang \"#!\" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack."},"relatedVulnerabilities":[{"id":"CVE-2023-39318","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39318","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39318","date":"2026-10-28","epss":0.0093,"percentile":0.60468}],"urls":["https://go.dev/cl/526156","https://go.dev/issue/62196","https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ","https://pkg.go.dev/vuln/GO-2023-2041","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231020-0009/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39318","description":"The html/template package does not properly handle HTML-like \"\" comment tokens, nor hashbang \"#!\" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.20.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-2043","versionConstraint":"<1.20.8||>=1.21.0-0,<1.21.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-2043","fix":{"state":"fixed","versions":["1.20.8","1.21.1"],"available":[{"date":"2023-09-06","kind":"release","version":"1.20.8"},{"date":"2023-09-06","kind":"release","version":"1.21.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39319","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39319","date":"2026-10-28","epss":0.00911,"percentile":0.59876}],"risk":0.505605,"urls":["https://go.dev/cl/526157","https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/62197","description":"The html/template package does not apply the proper rules for handling occurrences of \"<script\", \"<!--\", and \"</script\" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack."},"relatedVulnerabilities":[{"id":"CVE-2023-39319","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39319","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39319","date":"2026-10-28","epss":0.00911,"percentile":0.59876}],"urls":["https://go.dev/cl/526157","https://go.dev/issue/62197","https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ","https://pkg.go.dev/vuln/GO-2023-2043","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231020-0009/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39319","description":"The html/template package does not apply the proper rules for handling occurrences of \"<script\", \"<!--\", and \"</script\" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2600","versionConstraint":"<1.21.8||>=1.22.0-0,<1.22.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2600","fix":{"state":"fixed","versions":["1.21.8","1.22.1"],"available":[{"date":"2024-03-05","kind":"release","version":"1.21.8"},{"date":"2024-03-05","kind":"release","version":"1.22.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45289","date":"2026-10-28","epss":0.0108,"percentile":0.65}],"risk":0.5022,"urls":["https://go.dev/cl/569340","https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/65065","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not.\n\nA maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded."},"relatedVulnerabilities":[{"id":"CVE-2023-45289","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45289","date":"2026-10-28","epss":0.0108,"percentile":0.65}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/08/4","https://go.dev/cl/569340","https://go.dev/issue/65065","https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg","https://pkg.go.dev/vuln/GO-2024-2600","https://security.netapp.com/advisory/ntap-20240329-0006/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45289","description":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4009","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4009","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61723","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61723","date":"2026-10-28","epss":0.00661,"percentile":0.51498}],"risk":0.49575,"urls":["https://go.dev/cl/709858","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75676","description":"The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input.\n\nThis affects programs which parse untrusted PEM inputs."},"relatedVulnerabilities":[{"id":"CVE-2025-61723","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61723","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61723","date":"2026-10-28","epss":0.00661,"percentile":0.51498}],"urls":["https://go.dev/cl/709858","https://go.dev/issue/75676","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4009","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61723","description":"The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4006","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4006","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61725","date":"2026-10-28","epss":0.00647,"percentile":0.50891}],"risk":0.48525,"urls":["https://go.dev/issue/75680","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709860","description":"The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61725","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61725","date":"2026-10-28","epss":0.00647,"percentile":0.50891}],"urls":["https://go.dev/cl/709860","https://go.dev/issue/75680","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4006","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61725","description":"The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4971","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4971","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39836","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39836","date":"2026-10-28","epss":0.00633,"percentile":0.50184}],"risk":0.47475,"urls":["https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://go.dev/cl/775320"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79006","description":"The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)."},"relatedVulnerabilities":[{"id":"CVE-2026-39836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39836","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39836","date":"2026-10-28","epss":0.00633,"percentile":0.50184}],"urls":["https://go.dev/cl/775320","https://go.dev/issue/79006","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4971"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39836","description":"The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6603","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78659","date":"2026-10-28","epss":0.00627,"percentile":0.49926}],"risk":0.47025,"urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847185","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."},"relatedVulnerabilities":[{"id":"CVE-2026-78659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78659","date":"2026-10-28","epss":0.00627,"percentile":0.49926}],"urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4870","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4870","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32283","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-32283","cwe":"CWE-764","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32283","date":"2026-10-28","epss":0.00621,"percentile":0.49638}],"risk":0.46575,"urls":["https://go.dev/issue/78334","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763767","description":"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.\n\nThis only affects TLS 1.3."},"relatedVulnerabilities":[{"id":"CVE-2026-32283","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32283","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-32283","cwe":"CWE-764","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32283","date":"2026-10-28","epss":0.00621,"percentile":0.49638}],"urls":["https://go.dev/cl/763767","https://go.dev/issue/78334","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4870","https://access.redhat.com/errata/RHSA-2026:10217","https://access.redhat.com/errata/RHSA-2026:10219","https://access.redhat.com/errata/RHSA-2026:10704","https://access.redhat.com/errata/RHSA-2026:11507","https://access.redhat.com/errata/RHSA-2026:11514","https://access.redhat.com/errata/RHSA-2026:11704","https://access.redhat.com/errata/RHSA-2026:11711","https://access.redhat.com/errata/RHSA-2026:11712","https://access.redhat.com/errata/RHSA-2026:11863","https://access.redhat.com/errata/RHSA-2026:11881","https://access.redhat.com/errata/RHSA-2026:14162","https://access.redhat.com/errata/RHSA-2026:14200","https://access.redhat.com/errata/RHSA-2026:14391","https://access.redhat.com/errata/RHSA-2026:15980","https://access.redhat.com/errata/RHSA-2026:16021","https://access.redhat.com/errata/RHSA-2026:16024","https://access.redhat.com/errata/RHSA-2026:16101","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17075","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:18027","https://access.redhat.com/errata/RHSA-2026:18032","https://access.redhat.com/errata/RHSA-2026:19126","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19134","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19136","https://access.redhat.com/errata/RHSA-2026:19137","https://access.redhat.com/errata/RHSA-2026:19139","https://access.redhat.com/errata/RHSA-2026:19144","https://access.redhat.com/errata/RHSA-2026:19156","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19351","https://access.redhat.com/errata/RHSA-2026:19352","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19369","https://access.redhat.com/errata/RHSA-2026:19450","https://access.redhat.com/errata/RHSA-2026:19550","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19714","https://access.redhat.com/errata/RHSA-2026:19715","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19722","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:19839","https://access.redhat.com/errata/RHSA-2026:20556","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20570","https://access.redhat.com/errata/RHSA-2026:20571","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20608","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22709","https://access.redhat.com/errata/RHSA-2026:22713","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23102","https://access.redhat.com/errata/RHSA-2026:23103","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24337","https://access.redhat.com/errata/RHSA-2026:24470","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:26447","https://access.redhat.com/errata/RHSA-2026:26571","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28038","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28074","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:47712","https://access.redhat.com/errata/RHSA-2026:47714","https://access.redhat.com/errata/RHSA-2026:47716","https://access.redhat.com/errata/RHSA-2026:47719","https://access.redhat.com/errata/RHSA-2026:47721","https://access.redhat.com/errata/RHSA-2026:47722","https://access.redhat.com/errata/RHSA-2026:47910","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49509","https://access.redhat.com/errata/RHSA-2026:49600","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:55898","https://access.redhat.com/errata/RHSA-2026:55900","https://access.redhat.com/errata/RHSA-2026:55901","https://access.redhat.com/errata/RHSA-2026:55902","https://access.redhat.com/errata/RHSA-2026:55903","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:57409","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:57802","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65343","https://access.redhat.com/errata/RHSA-2026:65514","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66084","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:66523","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/security/cve/CVE-2026-32283","https://bugzilla.redhat.com/show_bug.cgi?id=2456338","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32283","description":"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.20.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-2186","versionConstraint":"<1.20.11||>=1.21.0-0,<1.21.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-2186","fix":{"state":"fixed","versions":["1.20.11","1.21.4"],"available":[{"date":"2023-11-07","kind":"release","version":"1.20.11"},{"date":"2023-11-07","kind":"release","version":"1.21.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45284","date":"2026-10-28","epss":0.00903,"percentile":0.59637}],"risk":0.46504500000000004,"urls":["https://go.dev/cl/540277","https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/63713","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases.\n\nReserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local.\n\nWith fix, IsLocal now correctly reports these names as non-local."},"relatedVulnerabilities":[{"id":"CVE-2023-45284","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45284","date":"2026-10-28","epss":0.00903,"percentile":0.59637}],"urls":["https://go.dev/cl/540277","https://go.dev/issue/63713","https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY","https://pkg.go.dev/vuln/GO-2023-2186"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45284","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4947","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4947","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32280","date":"2026-10-28","epss":0.00615,"percentile":0.49298}],"risk":0.46125000000000005,"urls":["https://go.dev/issue/78282","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/758320","description":"During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls."},"relatedVulnerabilities":[{"id":"CVE-2026-32280","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32280","date":"2026-10-28","epss":0.00615,"percentile":0.49298}],"urls":["https://go.dev/cl/758320","https://go.dev/issue/78282","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4947","https://access.redhat.com/errata/RHSA-2026:10217","https://access.redhat.com/errata/RHSA-2026:10219","https://access.redhat.com/errata/RHSA-2026:10704","https://access.redhat.com/errata/RHSA-2026:11507","https://access.redhat.com/errata/RHSA-2026:11514","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14020","https://access.redhat.com/errata/RHSA-2026:14162","https://access.redhat.com/errata/RHSA-2026:14200","https://access.redhat.com/errata/RHSA-2026:14391","https://access.redhat.com/errata/RHSA-2026:15980","https://access.redhat.com/errata/RHSA-2026:16021","https://access.redhat.com/errata/RHSA-2026:16024","https://access.redhat.com/errata/RHSA-2026:16101","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16477","https://access.redhat.com/errata/RHSA-2026:16505","https://access.redhat.com/errata/RHSA-2026:16508","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16537","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:18027","https://access.redhat.com/errata/RHSA-2026:18032","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19144","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19450","https://access.redhat.com/errata/RHSA-2026:19550","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19714","https://access.redhat.com/errata/RHSA-2026:19715","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19722","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:19839","https://access.redhat.com/errata/RHSA-2026:20556","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20570","https://access.redhat.com/errata/RHSA-2026:20571","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20608","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21655","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22130","https://access.redhat.com/errata/RHSA-2026:22141","https://access.redhat.com/errata/RHSA-2026:22258","https://access.redhat.com/errata/RHSA-2026:22260","https://access.redhat.com/errata/RHSA-2026:22268","https://access.redhat.com/errata/RHSA-2026:22309","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22415","https://access.redhat.com/errata/RHSA-2026:22422","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22709","https://access.redhat.com/errata/RHSA-2026:22713","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:22862","https://access.redhat.com/errata/RHSA-2026:22958","https://access.redhat.com/errata/RHSA-2026:22959","https://access.redhat.com/errata/RHSA-2026:22960","https://access.redhat.com/errata/RHSA-2026:22961","https://access.redhat.com/errata/RHSA-2026:22962","https://access.redhat.com/errata/RHSA-2026:23102","https://access.redhat.com/errata/RHSA-2026:23103","https://access.redhat.com/errata/RHSA-2026:23244","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24337","https://access.redhat.com/errata/RHSA-2026:24359","https://access.redhat.com/errata/RHSA-2026:24470","https://access.redhat.com/errata/RHSA-2026:24478","https://access.redhat.com/errata/RHSA-2026:24716","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25180","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26447","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26571","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28038","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28074","https://access.redhat.com/errata/RHSA-2026:28196","https://access.redhat.com/errata/RHSA-2026:28198","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29702","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:39894","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:47712","https://access.redhat.com/errata/RHSA-2026:47714","https://access.redhat.com/errata/RHSA-2026:47716","https://access.redhat.com/errata/RHSA-2026:47719","https://access.redhat.com/errata/RHSA-2026:47721","https://access.redhat.com/errata/RHSA-2026:47722","https://access.redhat.com/errata/RHSA-2026:47910","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49509","https://access.redhat.com/errata/RHSA-2026:49526","https://access.redhat.com/errata/RHSA-2026:49600","https://access.redhat.com/errata/RHSA-2026:49838","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56855","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56913","https://access.redhat.com/errata/RHSA-2026:57409","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:59834","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61685","https://access.redhat.com/errata/RHSA-2026:61906","https://access.redhat.com/errata/RHSA-2026:61907","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/security/cve/CVE-2026-32280","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280","description":"During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6611","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78669","date":"2026-10-28","epss":0.00614,"percentile":0.49266}],"risk":0.46049999999999996,"urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847186","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."},"relatedVulnerabilities":[{"id":"CVE-2026-78669","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78669","date":"2026-10-28","epss":0.00614,"percentile":0.49266}],"urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44656","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-44656","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44656","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44656","date":"2026-10-28","epss":0.00917,"percentile":0.60089}],"risk":0.45849999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44656"},"relatedVulnerabilities":[{"id":"CVE-2026-44656","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44656","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44656","date":"2026-10-28","epss":0.00917,"percentile":0.60089}],"urls":["https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0","https://github.com/vim/vim/releases/tag/v9.2.0435","https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44656","description":"Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44656","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-44656","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44656","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44656","date":"2026-10-28","epss":0.00917,"percentile":0.60089}],"risk":0.45849999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44656"},"relatedVulnerabilities":[{"id":"CVE-2026-44656","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44656","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44656","date":"2026-10-28","epss":0.00917,"percentile":0.60089}],"urls":["https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0","https://github.com/vim/vim/releases/tag/v9.2.0435","https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44656","description":"Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44656","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-44656","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44656","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44656","date":"2026-10-28","epss":0.00917,"percentile":0.60089}],"risk":0.45849999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44656"},"relatedVulnerabilities":[{"id":"CVE-2026-44656","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44656","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44656","date":"2026-10-28","epss":0.00917,"percentile":0.60089}],"urls":["https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0","https://github.com/vim/vim/releases/tag/v9.2.0435","https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44656","description":"Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-28","epss":0.00916,"percentile":0.6007}],"risk":0.45799999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-28","epss":0.00916,"percentile":0.6007}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-28","epss":0.00916,"percentile":0.6007}],"risk":0.45799999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-28","epss":0.00916,"percentile":0.6007}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-32990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-32990","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-32990","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32990","date":"2026-10-28","epss":0.00896,"percentile":0.59423}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32990"},"relatedVulnerabilities":[{"id":"CVE-2025-32990","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32990","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32990","date":"2026-10-28","epss":0.00896,"percentile":0.59423}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:17415","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/errata/RHSA-2026:7477","https://access.redhat.com/security/cve/CVE-2025-32990","https://bugzilla.redhat.com/show_bug.cgi?id=2359620","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32990","description":"A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5037","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5037","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27145","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27145","date":"2026-10-28","epss":0.00591,"percentile":0.48112}],"risk":0.4432500000000001,"urls":["https://go.dev/issue/79694","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/783621","description":"(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname.\n\nWith a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."},"relatedVulnerabilities":[{"id":"CVE-2026-27145","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27145","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27145","date":"2026-10-28","epss":0.00591,"percentile":0.48112}],"urls":["https://go.dev/cl/783621","https://go.dev/issue/79694","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5037","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:29980","https://access.redhat.com/errata/RHSA-2026:29981","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:35832","https://access.redhat.com/errata/RHSA-2026:36317","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42946","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:46394","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49703","https://access.redhat.com/errata/RHSA-2026:49705","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:49729","https://access.redhat.com/errata/RHSA-2026:49744","https://access.redhat.com/errata/RHSA-2026:49765","https://access.redhat.com/errata/RHSA-2026:49770","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:52946","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53416","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54168","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54427","https://access.redhat.com/errata/RHSA-2026:54432","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54500","https://access.redhat.com/errata/RHSA-2026:54525","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:55899","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68335","https://access.redhat.com/security/cve/CVE-2026-27145","https://bugzilla.redhat.com/show_bug.cgi?id=2484207","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27145","description":"(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53906","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53906","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53906","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53906","date":"2026-10-28","epss":0.00871,"percentile":0.58712}],"risk":0.43550000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53906"},"relatedVulnerabilities":[{"id":"CVE-2025-53906","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L","metrics":{"baseScore":4.1,"impactScore":2.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53906","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53906","date":"2026-10-28","epss":0.00871,"percentile":0.58712}],"urls":["https://github.com/vim/vim/commit/586294a04179d855c3d1d4ee5ea83931963680b8","https://github.com/vim/vim/security/advisories/GHSA-r2fw-9cw4-mj86","http://www.openwall.com/lists/oss-security/2025/07/15/2","http://www.openwall.com/lists/oss-security/2026/04/01/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53906","description":"Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1551 contains a patch for the vulnerability."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53906","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53906","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53906","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53906","date":"2026-10-28","epss":0.00871,"percentile":0.58712}],"risk":0.43550000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53906"},"relatedVulnerabilities":[{"id":"CVE-2025-53906","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L","metrics":{"baseScore":4.1,"impactScore":2.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53906","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53906","date":"2026-10-28","epss":0.00871,"percentile":0.58712}],"urls":["https://github.com/vim/vim/commit/586294a04179d855c3d1d4ee5ea83931963680b8","https://github.com/vim/vim/security/advisories/GHSA-r2fw-9cw4-mj86","http://www.openwall.com/lists/oss-security/2025/07/15/2","http://www.openwall.com/lists/oss-security/2026/04/01/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53906","description":"Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1551 contains a patch for the vulnerability."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53906","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53906","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53906","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53906","date":"2026-10-28","epss":0.00871,"percentile":0.58712}],"risk":0.43550000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53906"},"relatedVulnerabilities":[{"id":"CVE-2025-53906","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L","metrics":{"baseScore":4.1,"impactScore":2.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53906","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53906","date":"2026-10-28","epss":0.00871,"percentile":0.58712}],"urls":["https://github.com/vim/vim/commit/586294a04179d855c3d1d4ee5ea83931963680b8","https://github.com/vim/vim/security/advisories/GHSA-r2fw-9cw4-mj86","http://www.openwall.com/lists/oss-security/2025/07/15/2","http://www.openwall.com/lists/oss-security/2026/04/01/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53906","description":"Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1551 contains a patch for the vulnerability."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33412","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-33412","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33412","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33412","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33412","date":"2026-10-28","epss":0.00867,"percentile":0.58583}],"risk":0.43350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33412"},"relatedVulnerabilities":[{"id":"CVE-2026-33412","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.6,"impactScore":4.3,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33412","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33412","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33412","date":"2026-10-28","epss":0.00867,"percentile":0.58583}],"urls":["https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a","https://github.com/vim/vim/releases/tag/v9.2.0202","https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c","http://www.openwall.com/lists/oss-security/2026/03/19/10","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:10097","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:12274","https://access.redhat.com/errata/RHSA-2026:14773","https://access.redhat.com/errata/RHSA-2026:15087","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17596","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:6502","https://access.redhat.com/errata/RHSA-2026:6539","https://access.redhat.com/errata/RHSA-2026:6540","https://access.redhat.com/errata/RHSA-2026:6617","https://access.redhat.com/errata/RHSA-2026:6619","https://access.redhat.com/errata/RHSA-2026:6620","https://access.redhat.com/errata/RHSA-2026:6725","https://access.redhat.com/errata/RHSA-2026:6729","https://access.redhat.com/errata/RHSA-2026:6730","https://access.redhat.com/errata/RHSA-2026:6731","https://access.redhat.com/errata/RHSA-2026:6736","https://access.redhat.com/errata/RHSA-2026:6915","https://access.redhat.com/errata/RHSA-2026:7239","https://access.redhat.com/errata/RHSA-2026:7243","https://access.redhat.com/errata/RHSA-2026:7335","https://access.redhat.com/errata/RHSA-2026:7711","https://access.redhat.com/errata/RHSA-2026:8259","https://access.redhat.com/errata/RHSA-2026:8423","https://access.redhat.com/errata/RHSA-2026:9832","https://access.redhat.com/security/cve/CVE-2026-33412","https://bugzilla.redhat.com/show_bug.cgi?id=2450907","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33412.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33412","description":"Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33412","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-33412","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33412","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33412","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33412","date":"2026-10-28","epss":0.00867,"percentile":0.58583}],"risk":0.43350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33412"},"relatedVulnerabilities":[{"id":"CVE-2026-33412","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.6,"impactScore":4.3,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33412","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33412","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33412","date":"2026-10-28","epss":0.00867,"percentile":0.58583}],"urls":["https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a","https://github.com/vim/vim/releases/tag/v9.2.0202","https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c","http://www.openwall.com/lists/oss-security/2026/03/19/10","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:10097","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:12274","https://access.redhat.com/errata/RHSA-2026:14773","https://access.redhat.com/errata/RHSA-2026:15087","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17596","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:6502","https://access.redhat.com/errata/RHSA-2026:6539","https://access.redhat.com/errata/RHSA-2026:6540","https://access.redhat.com/errata/RHSA-2026:6617","https://access.redhat.com/errata/RHSA-2026:6619","https://access.redhat.com/errata/RHSA-2026:6620","https://access.redhat.com/errata/RHSA-2026:6725","https://access.redhat.com/errata/RHSA-2026:6729","https://access.redhat.com/errata/RHSA-2026:6730","https://access.redhat.com/errata/RHSA-2026:6731","https://access.redhat.com/errata/RHSA-2026:6736","https://access.redhat.com/errata/RHSA-2026:6915","https://access.redhat.com/errata/RHSA-2026:7239","https://access.redhat.com/errata/RHSA-2026:7243","https://access.redhat.com/errata/RHSA-2026:7335","https://access.redhat.com/errata/RHSA-2026:7711","https://access.redhat.com/errata/RHSA-2026:8259","https://access.redhat.com/errata/RHSA-2026:8423","https://access.redhat.com/errata/RHSA-2026:9832","https://access.redhat.com/security/cve/CVE-2026-33412","https://bugzilla.redhat.com/show_bug.cgi?id=2450907","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33412.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33412","description":"Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33412","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-33412","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33412","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33412","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33412","date":"2026-10-28","epss":0.00867,"percentile":0.58583}],"risk":0.43350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33412"},"relatedVulnerabilities":[{"id":"CVE-2026-33412","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.6,"impactScore":4.3,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33412","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33412","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33412","date":"2026-10-28","epss":0.00867,"percentile":0.58583}],"urls":["https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a","https://github.com/vim/vim/releases/tag/v9.2.0202","https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c","http://www.openwall.com/lists/oss-security/2026/03/19/10","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:10097","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:12274","https://access.redhat.com/errata/RHSA-2026:14773","https://access.redhat.com/errata/RHSA-2026:15087","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17596","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:6502","https://access.redhat.com/errata/RHSA-2026:6539","https://access.redhat.com/errata/RHSA-2026:6540","https://access.redhat.com/errata/RHSA-2026:6617","https://access.redhat.com/errata/RHSA-2026:6619","https://access.redhat.com/errata/RHSA-2026:6620","https://access.redhat.com/errata/RHSA-2026:6725","https://access.redhat.com/errata/RHSA-2026:6729","https://access.redhat.com/errata/RHSA-2026:6730","https://access.redhat.com/errata/RHSA-2026:6731","https://access.redhat.com/errata/RHSA-2026:6736","https://access.redhat.com/errata/RHSA-2026:6915","https://access.redhat.com/errata/RHSA-2026:7239","https://access.redhat.com/errata/RHSA-2026:7243","https://access.redhat.com/errata/RHSA-2026:7335","https://access.redhat.com/errata/RHSA-2026:7711","https://access.redhat.com/errata/RHSA-2026:8259","https://access.redhat.com/errata/RHSA-2026:8423","https://access.redhat.com/errata/RHSA-2026:9832","https://access.redhat.com/security/cve/CVE-2026-33412","https://bugzilla.redhat.com/show_bug.cgi?id=2450907","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33412.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33412","description":"Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-28","epss":0.00859,"percentile":0.58344}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-28","epss":0.00859,"percentile":0.58344}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-28","epss":0.00859,"percentile":0.58344}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-28","epss":0.00859,"percentile":0.58344}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-28","epss":0.00859,"percentile":0.58344}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-28","epss":0.00859,"percentile":0.58344}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-28","epss":0.00859,"percentile":0.58344}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-10-28","epss":0.00859,"percentile":0.58344}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5972","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5972","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33818","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-33818","date":"2026-10-28","epss":0.00568,"percentile":0.46942}],"risk":0.426,"urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/814980"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80405","description":"Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."},"relatedVulnerabilities":[{"id":"CVE-2026-33818","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33818","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-33818","date":"2026-10-28","epss":0.00568,"percentile":0.46942}],"urls":["https://go.dev/cl/814980","https://go.dev/issue/80405","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-5972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","description":"Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6088","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6088","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56859","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56859","date":"2026-10-28","epss":0.00568,"percentile":0.46942}],"risk":0.426,"urls":["https://go.dev/cl/803320","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80481","description":"Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-56859","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56859","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56859","date":"2026-10-28","epss":0.00568,"percentile":0.46942}],"urls":["https://go.dev/cl/803320","https://go.dev/issue/80481","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6088"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","description":"Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6090","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6090","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56862","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56862","date":"2026-10-28","epss":0.00568,"percentile":0.46942}],"risk":0.426,"urls":["https://go.dev/cl/804261","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80528","description":"Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."},"relatedVulnerabilities":[{"id":"CVE-2026-56862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56862","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56862","date":"2026-10-28","epss":0.00568,"percentile":0.46942}],"urls":["https://go.dev/cl/804261","https://go.dev/issue/80528","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6090"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","description":"Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6089","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6089","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56853","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56853","date":"2026-10-28","epss":0.00568,"percentile":0.46941}],"risk":0.426,"urls":["https://go.dev/cl/795540","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80205","description":"When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."},"relatedVulnerabilities":[{"id":"CVE-2026-56853","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56853","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56853","date":"2026-10-28","epss":0.00568,"percentile":0.46941}],"urls":["https://go.dev/cl/795540","https://go.dev/issue/80205","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6089"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","description":"When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4342","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4342","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61728","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61728","date":"2026-10-28","epss":0.00738,"percentile":0.54392}],"risk":0.42435,"urls":["https://go.dev/issue/77102","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/736713","description":"archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive."},"relatedVulnerabilities":[{"id":"CVE-2025-61728","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61728","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61728","date":"2026-10-28","epss":0.00738,"percentile":0.54392}],"urls":["https://go.dev/cl/736713","https://go.dev/issue/77102","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4342","http://www.openwall.com/lists/oss-security/2026/01/15/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61728","description":"archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5038","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5038","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42504","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42504","date":"2026-10-28","epss":0.0056,"percentile":0.46507}],"risk":0.42,"urls":["https://go.dev/cl/774481","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79217","description":"Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-42504","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42504","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42504","date":"2026-10-28","epss":0.0056,"percentile":0.46507}],"urls":["https://go.dev/cl/774481","https://go.dev/issue/79217","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5038"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","description":"Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2610","versionConstraint":"<1.21.8||>=1.22.0-0,<1.22.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2610","fix":{"state":"fixed","versions":["1.21.8","1.22.1"],"available":[{"date":"2024-03-05","kind":"release","version":"1.21.8"},{"date":"2024-03-05","kind":"release","version":"1.22.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24785","date":"2026-10-28","epss":0.00795,"percentile":0.56301}],"risk":0.41340000000000005,"urls":["https://go.dev/cl/564196","https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/65697","description":"If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates."},"relatedVulnerabilities":[{"id":"CVE-2024-24785","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24785","date":"2026-10-28","epss":0.00795,"percentile":0.56301}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/08/4","https://go.dev/cl/564196","https://go.dev/issue/65697","https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg","https://pkg.go.dev/vuln/GO-2024-2610","https://security.netapp.com/advisory/ntap-20240329-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-24785","description":"If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates."}]},{"artifact":{"id":"b79088d6a375b1c0","cpes":["cpe:2.3:a:patch:patch:2.7.6-6:*:*:*:*:*:*:*"],"name":"patch","purl":"pkg:deb/ubuntu/patch@2.7.6-6?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"2.7.6-6","language":"","licenses":["sha256:8c70d7b0af209abe627c97cd21883931b891c820d0a4affcc10b789a23538a0d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/patch/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/patch/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/patch.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/patch.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/patch.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/patch.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"patch","version":"2.7.6-6"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2018-6952","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6952","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6952","date":"2026-10-28","epss":0.0819,"percentile":0.94849}],"risk":0.40950000000000003,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-6952"},"relatedVulnerabilities":[{"id":"CVE-2018-6952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6952","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6952","date":"2026-10-28","epss":0.0819,"percentile":0.94849}],"urls":["http://www.securityfocus.com/bid/103047","https://access.redhat.com/errata/RHSA-2019:2033","https://savannah.gnu.org/bugs/index.php?53133","https://security.gentoo.org/glsa/201904-17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6952","description":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-3420","versionConstraint":"<1.22.11||>=1.23.0-0,<1.23.5||>=1.24.0-0,<1.24.0-rc.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-3420","fix":{"state":"fixed","versions":["1.22.11","1.23.5","1.24.0-rc.2"],"available":[{"date":"2025-01-16","kind":"release","version":"1.22.11"},{"date":"2025-01-16","kind":"release","version":"1.23.5"},{"date":"2025-01-16","kind":"release","version":"1.24.0-rc.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45336","date":"2026-10-28","epss":0.00726,"percentile":0.5396}],"risk":0.40292999999999995,"urls":["https://go.dev/issue/70530","https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ","https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/643100","description":"The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com.\n\nIn the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2."},"relatedVulnerabilities":[{"id":"CVE-2024-45336","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45336","date":"2026-10-28","epss":0.00726,"percentile":0.5396}],"urls":["https://go.dev/cl/643100","https://go.dev/issue/70530","https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ","https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ","https://pkg.go.dev/vuln/GO-2025-3420","https://security.netapp.com/advisory/ntap-20250221-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45336","description":"The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2."}]},{"artifact":{"id":"b249116c08a3f0ed","cpes":["cpe:2.3:a:libnghttp2-14:libnghttp2-14:1.40.0-1ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2-14:libnghttp2_14:1.40.0-1ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2-14:1.40.0-1ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2_14:1.40.0-1ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2-14:1.40.0-1ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2_14:1.40.0-1ubuntu0.3:*:*:*:*:*:*:*"],"name":"libnghttp2-14","purl":"pkg:deb/ubuntu/libnghttp2-14@1.40.0-1ubuntu0.3?arch=amd64&distro=ubuntu-20.04&upstream=nghttp2","type":"deb","version":"1.40.0-1ubuntu0.3","language":"","licenses":["BSD-2-clause","Expat","GPL-3","GPL-3+","MIT","SIL-OFL-1.1","all-permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnghttp2-14/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libnghttp2-14/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nghttp2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27135","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"nghttp2","version":"1.40.0-1ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-27135","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27135","date":"2026-10-28","epss":0.00805,"percentile":0.56632}],"risk":0.40249999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-27135"},"relatedVulnerabilities":[{"id":"CVE-2026-27135","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27135","date":"2026-10-28","epss":0.00805,"percentile":0.56632}],"urls":["https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1","https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6","http://www.openwall.com/lists/oss-security/2026/03/20/3","https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:14773","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:15087","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16030","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17596","https://access.redhat.com/errata/RHSA-2026:19724","https://access.redhat.com/errata/RHSA-2026:19725","https://access.redhat.com/errata/RHSA-2026:20040","https://access.redhat.com/errata/RHSA-2026:20087","https://access.redhat.com/errata/RHSA-2026:21656","https://access.redhat.com/errata/RHSA-2026:21690","https://access.redhat.com/errata/RHSA-2026:21695","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:27200","https://access.redhat.com/errata/RHSA-2026:27201","https://access.redhat.com/errata/RHSA-2026:6190","https://access.redhat.com/errata/RHSA-2026:7080","https://access.redhat.com/errata/RHSA-2026:7123","https://access.redhat.com/errata/RHSA-2026:7302","https://access.redhat.com/errata/RHSA-2026:7310","https://access.redhat.com/errata/RHSA-2026:7350","https://access.redhat.com/errata/RHSA-2026:7666","https://access.redhat.com/errata/RHSA-2026:7667","https://access.redhat.com/errata/RHSA-2026:7668","https://access.redhat.com/errata/RHSA-2026:7670","https://access.redhat.com/errata/RHSA-2026:7675","https://access.redhat.com/errata/RHSA-2026:7896","https://access.redhat.com/errata/RHSA-2026:7983","https://access.redhat.com/errata/RHSA-2026:8339","https://access.redhat.com/errata/RHSA-2026:8538","https://access.redhat.com/errata/RHSA-2026:8539","https://access.redhat.com/errata/RHSA-2026:8540","https://access.redhat.com/errata/RHSA-2026:8541","https://access.redhat.com/errata/RHSA-2026:8545","https://access.redhat.com/errata/RHSA-2026:8546","https://access.redhat.com/errata/RHSA-2026:8547","https://access.redhat.com/errata/RHSA-2026:8548","https://access.redhat.com/errata/RHSA-2026:8868","https://access.redhat.com/errata/RHSA-2026:9711","https://access.redhat.com/errata/RHSA-2026:9832","https://access.redhat.com/errata/RHSA-2026:9874","https://access.redhat.com/security/cve/CVE-2026-27135","https://bugzilla.redhat.com/show_bug.cgi?id=2448754","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27135","description":"nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-12084","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-10-28","epss":0.00799,"percentile":0.56405}],"risk":0.3995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12084"},"relatedVulnerabilities":[{"id":"CVE-2025-12084","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-10-28","epss":0.00799,"percentile":0.56405}],"urls":["https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0","https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4","https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437","https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af","https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273","https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907","https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d","https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8","https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8","https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0","https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964","https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53","https://github.com/python/cpython/issues/142145","https://github.com/python/cpython/pull/142146"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","description":"When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-12084","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-10-28","epss":0.00799,"percentile":0.56405}],"risk":0.3995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12084"},"relatedVulnerabilities":[{"id":"CVE-2025-12084","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-10-28","epss":0.00799,"percentile":0.56405}],"urls":["https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0","https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4","https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437","https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af","https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273","https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907","https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d","https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8","https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8","https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0","https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964","https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53","https://github.com/python/cpython/issues/142145","https://github.com/python/cpython/pull/142146"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","description":"When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-12084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-12084","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-10-28","epss":0.00799,"percentile":0.56405}],"risk":0.3995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12084"},"relatedVulnerabilities":[{"id":"CVE-2025-12084","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-10-28","epss":0.00799,"percentile":0.56405}],"urls":["https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0","https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4","https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437","https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af","https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273","https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907","https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d","https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8","https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8","https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0","https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964","https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53","https://github.com/python/cpython/issues/142145","https://github.com/python/cpython/pull/142146"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","description":"When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-12084","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-10-28","epss":0.00799,"percentile":0.56405}],"risk":0.3995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12084"},"relatedVulnerabilities":[{"id":"CVE-2025-12084","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12084","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12084","date":"2026-10-28","epss":0.00799,"percentile":0.56405}],"urls":["https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0","https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4","https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437","https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af","https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273","https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907","https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d","https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8","https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8","https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0","https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964","https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53","https://github.com/python/cpython/issues/142145","https://github.com/python/cpython/pull/142146"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","description":"When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-3751","versionConstraint":"<1.23.10||>=1.24.0-0,<1.24.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-3751","fix":{"state":"fixed","versions":["1.23.10","1.24.4"],"available":[{"date":"2025-06-05","kind":"release","version":"1.23.10"},{"date":"2025-06-05","kind":"release","version":"1.24.4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-4673","date":"2026-10-28","epss":0.00666,"percentile":0.51675}],"risk":0.39293999999999996,"urls":["https://go.dev/issue/73816","https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/679257","description":"Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2025-4673","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-4673","date":"2026-10-28","epss":0.00666,"percentile":0.51675}],"urls":["https://go.dev/cl/679257","https://go.dev/issue/73816","https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A","https://pkg.go.dev/vuln/GO-2025-3751"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4673","description":"Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-3105","versionConstraint":"<1.22.7||>=1.23.0-0,<1.23.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-3105","fix":{"state":"fixed","versions":["1.22.7","1.23.1"],"available":[{"date":"2024-09-05","kind":"release","version":"1.22.7"},{"date":"2024-09-05","kind":"release","version":"1.23.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-34155","date":"2026-10-28","epss":0.00839,"percentile":0.57692}],"risk":0.39013499999999995,"urls":["https://go.dev/issue/69138","https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/611238","description":"Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2024-34155","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-34155","date":"2026-10-28","epss":0.00839,"percentile":0.57692}],"urls":["https://go.dev/cl/611238","https://go.dev/issue/69138","https://groups.google.com/g/golang-dev/c/S9POB9NCTdk","https://pkg.go.dev/vuln/GO-2024-3105","https://security.netapp.com/advisory/ntap-20240926-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-34155","description":"Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6607","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6607","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97031","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97031","date":"2026-10-28","epss":0.00519,"percentile":0.43947}],"risk":0.38925,"urls":["https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847312","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.\n\nWe now reject these as malformed and curb the memory amplification vector as a result."},"relatedVulnerabilities":[{"id":"CVE-2026-97031","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97031","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97031","date":"2026-10-28","epss":0.00519,"percentile":0.43947}],"urls":["https://go.dev/cl/847312","https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6607"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97031","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-10043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2011-10043","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-10-28","epss":0.00775,"percentile":0.55639}],"risk":0.3875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2011-10043"},"relatedVulnerabilities":[{"id":"CVE-2011-10043","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-10-28","epss":0.00775,"percentile":0.55639}],"urls":["https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html","https://metacpan.org/release/BINGOS/Module-Load-0.22/changes","https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-10043","description":"Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\n\nModule names starting with \"::\" could be passed to the load function to specify arbitrary module paths.\n\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2011-10043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2011-10043","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-10-28","epss":0.00775,"percentile":0.55639}],"risk":0.3875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2011-10043"},"relatedVulnerabilities":[{"id":"CVE-2011-10043","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-10-28","epss":0.00775,"percentile":0.55639}],"urls":["https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html","https://metacpan.org/release/BINGOS/Module-Load-0.22/changes","https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-10043","description":"Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\n\nModule names starting with \"::\" could be passed to the load function to specify arbitrary module paths.\n\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-10043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2011-10043","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-10-28","epss":0.00775,"percentile":0.55639}],"risk":0.3875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2011-10043"},"relatedVulnerabilities":[{"id":"CVE-2011-10043","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-10-28","epss":0.00775,"percentile":0.55639}],"urls":["https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html","https://metacpan.org/release/BINGOS/Module-Load-0.22/changes","https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-10043","description":"Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\n\nModule names starting with \"::\" could be passed to the load function to specify arbitrary module paths.\n\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-10043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2011-10043","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-10-28","epss":0.00775,"percentile":0.55639}],"risk":0.3875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2011-10043"},"relatedVulnerabilities":[{"id":"CVE-2011-10043","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-10-28","epss":0.00775,"percentile":0.55639}],"urls":["https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html","https://metacpan.org/release/BINGOS/Module-Load-0.22/changes","https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-10043","description":"Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\n\nModule names starting with \"::\" could be passed to the load function to specify arbitrary module paths.\n\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42307","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42307","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42307","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42307","date":"2026-10-28","epss":0.00774,"percentile":0.55595}],"risk":0.387,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42307"},"relatedVulnerabilities":[{"id":"CVE-2026-42307","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42307","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42307","date":"2026-10-28","epss":0.00774,"percentile":0.55595}],"urls":["https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc","https://github.com/vim/vim/releases/tag/v9.2.0383","https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42307","description":"Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42307","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42307","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42307","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42307","date":"2026-10-28","epss":0.00774,"percentile":0.55595}],"risk":0.387,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42307"},"relatedVulnerabilities":[{"id":"CVE-2026-42307","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42307","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42307","date":"2026-10-28","epss":0.00774,"percentile":0.55595}],"urls":["https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc","https://github.com/vim/vim/releases/tag/v9.2.0383","https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42307","description":"Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42307","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42307","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42307","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42307","date":"2026-10-28","epss":0.00774,"percentile":0.55595}],"risk":0.387,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42307"},"relatedVulnerabilities":[{"id":"CVE-2026-42307","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42307","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42307","date":"2026-10-28","epss":0.00774,"percentile":0.55595}],"urls":["https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc","https://github.com/vim/vim/releases/tag/v9.2.0383","https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42307","description":"Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6395","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6395","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6395","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6395","date":"2026-10-28","epss":0.00771,"percentile":0.55517}],"risk":0.3855,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6395"},"relatedVulnerabilities":[{"id":"CVE-2025-6395","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6395","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6395","date":"2026-10-28","epss":0.00771,"percentile":0.55517}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:17415","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/security/cve/CVE-2025-6395","https://bugzilla.redhat.com/show_bug.cgi?id=2376755","https://gitlab.com/gnutls/gnutls/-/issues/1718","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6395","description":"A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite()."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5260","cwe":"CWE-126","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5260","date":"2026-10-28","epss":0.00769,"percentile":0.55457}],"risk":0.3845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5260"},"relatedVulnerabilities":[{"id":"CVE-2026-5260","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5260","cwe":"CWE-126","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5260","date":"2026-10-28","epss":0.00769,"percentile":0.55457}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:67837","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:77320","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82811","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-5260","https://bugzilla.redhat.com/show_bug.cgi?id=2467450","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5260","description":"A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6608","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6608","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94440","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94440","date":"2026-10-28","epss":0.00511,"percentile":0.43469}],"risk":0.38325,"urls":["https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847307","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."},"relatedVulnerabilities":[{"id":"CVE-2026-94440","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94440","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94440","date":"2026-10-28","epss":0.00511,"percentile":0.43469}],"urls":["https://go.dev/cl/847307","https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6608"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94440","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-10-28","epss":0.0075,"percentile":0.54819}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-10-28","epss":0.0075,"percentile":0.54819}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-10-28","epss":0.0075,"percentile":0.54819}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-10-28","epss":0.0075,"percentile":0.54819}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-10-28","epss":0.0075,"percentile":0.54819}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-10-28","epss":0.0075,"percentile":0.54819}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-10-28","epss":0.0075,"percentile":0.54819}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-10-28","epss":0.0075,"percentile":0.54819}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"198ee162877e76c2","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.9-1ubuntu0.8:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.2.9-1ubuntu0.8?arch=amd64&distro=ubuntu-20.04&upstream=expat","type":"deb","version":"2.2.9-1ubuntu0.8","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66046","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"expat","version":"2.2.9-1ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-66046","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66046","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66046","date":"2026-10-28","epss":0.00742,"percentile":0.54533}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66046"},"relatedVulnerabilities":[{"id":"CVE-2026-66046","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66046","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66046","date":"2026-10-28","epss":0.00742,"percentile":0.54533}],"urls":["https://github.com/libexpat/libexpat/pull/1321","https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66046","description":"Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4176","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-10-28","epss":0.0074,"percentile":0.54454}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4176"},"relatedVulnerabilities":[{"id":"CVE-2026-4176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-10-28","epss":0.0074,"percentile":0.54454}],"urls":["https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94","https://lists.security.metacpan.org/cve-announce/msg/37638919/","https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes","https://metacpan.org/release/SHAY/perl-5.40.4/changes","https://metacpan.org/release/SHAY/perl-5.42.2/changes","https://www.cve.org/CVERecord?id=CVE-2026-3381","http://www.openwall.com/lists/oss-security/2026/03/30/2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4176","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.\n\nCompress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4176","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-10-28","epss":0.0074,"percentile":0.54454}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4176"},"relatedVulnerabilities":[{"id":"CVE-2026-4176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-10-28","epss":0.0074,"percentile":0.54454}],"urls":["https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94","https://lists.security.metacpan.org/cve-announce/msg/37638919/","https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes","https://metacpan.org/release/SHAY/perl-5.40.4/changes","https://metacpan.org/release/SHAY/perl-5.42.2/changes","https://www.cve.org/CVERecord?id=CVE-2026-3381","http://www.openwall.com/lists/oss-security/2026/03/30/2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4176","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.\n\nCompress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4176","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-10-28","epss":0.0074,"percentile":0.54454}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4176"},"relatedVulnerabilities":[{"id":"CVE-2026-4176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-10-28","epss":0.0074,"percentile":0.54454}],"urls":["https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94","https://lists.security.metacpan.org/cve-announce/msg/37638919/","https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes","https://metacpan.org/release/SHAY/perl-5.40.4/changes","https://metacpan.org/release/SHAY/perl-5.42.2/changes","https://www.cve.org/CVERecord?id=CVE-2026-3381","http://www.openwall.com/lists/oss-security/2026/03/30/2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4176","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.\n\nCompress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4176","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-10-28","epss":0.0074,"percentile":0.54454}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4176"},"relatedVulnerabilities":[{"id":"CVE-2026-4176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-10-28","epss":0.0074,"percentile":0.54454}],"urls":["https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94","https://lists.security.metacpan.org/cve-announce/msg/37638919/","https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes","https://metacpan.org/release/SHAY/perl-5.40.4/changes","https://metacpan.org/release/SHAY/perl-5.42.2/changes","https://www.cve.org/CVERecord?id=CVE-2026-3381","http://www.openwall.com/lists/oss-security/2026/03/30/2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4176","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.\n\nCompress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6617","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97032","date":"2026-10-28","epss":0.0049,"percentile":0.4201}],"risk":0.3675,"urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847188","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."},"relatedVulnerabilities":[{"id":"CVE-2026-97032","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97032","date":"2026-10-28","epss":0.0049,"percentile":0.4201}],"urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-28","epss":0.00734,"percentile":0.54262}],"risk":0.367,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-28","epss":0.00734,"percentile":0.54262}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-28","epss":0.00734,"percentile":0.54262}],"risk":0.367,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-28","epss":0.00734,"percentile":0.54262}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-28","epss":0.00734,"percentile":0.54262}],"risk":0.367,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-28","epss":0.00734,"percentile":0.54262}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-28","epss":0.00734,"percentile":0.54262}],"risk":0.367,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-10-28","epss":0.00734,"percentile":0.54262}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2598","versionConstraint":"<1.21.8||>=1.22.0-0,<1.22.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2598","fix":{"state":"fixed","versions":["1.21.8","1.22.1"],"available":[{"date":"2024-03-05","kind":"release","version":"1.21.8"},{"date":"2024-03-05","kind":"release","version":"1.22.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-24783","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-24783","date":"2026-10-28","epss":0.00667,"percentile":0.51716}],"risk":0.36351500000000003,"urls":["https://go.dev/cl/569339","https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/65390","description":"Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic.\n\nThis affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates."},"relatedVulnerabilities":[{"id":"CVE-2024-24783","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-24783","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-24783","date":"2026-10-28","epss":0.00667,"percentile":0.51716}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/08/4","https://go.dev/cl/569339","https://go.dev/issue/65390","https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg","https://pkg.go.dev/vuln/GO-2024-2598","https://security.netapp.com/advisory/ntap-20240329-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-24783","description":"Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42015","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42015","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42015","cwe":"CWE-193","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42015","date":"2026-10-28","epss":0.00727,"percentile":0.54017}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42015"},"relatedVulnerabilities":[{"id":"CVE-2026-42015","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42015","cwe":"CWE-193","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42015","date":"2026-10-28","epss":0.00727,"percentile":0.54017}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:43575","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42015","https://bugzilla.redhat.com/show_bug.cgi?id=2467678","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42015","description":"A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6609","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6609","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78667","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78667","date":"2026-10-28","epss":0.0048,"percentile":0.41318}],"risk":0.36,"urls":["https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847309","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-78667","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78667","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78667","date":"2026-10-28","epss":0.0048,"percentile":0.41318}],"urls":["https://go.dev/cl/847309","https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6609"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78667","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."}]},{"artifact":{"id":"34f967921c09dcd9","cpes":["cpe:2.3:a:curl:curl:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-28","epss":0.00719,"percentile":0.53763}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6253"},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-28","epss":0.00719,"percentile":0.53763}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"bf88a5f755934444","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-28","epss":0.00719,"percentile":0.53763}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6253"},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-28","epss":0.00719,"percentile":0.53763}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"25fcf12ace6abd0f","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-28","epss":0.00719,"percentile":0.53763}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6253"},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-28","epss":0.00719,"percentile":0.53763}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-28","epss":0.00715,"percentile":0.53611}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-28","epss":0.00715,"percentile":0.53611}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-28","epss":0.00715,"percentile":0.53611}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-28","epss":0.00715,"percentile":0.53611}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-28","epss":0.00715,"percentile":0.53611}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-28","epss":0.00715,"percentile":0.53611}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-28","epss":0.00715,"percentile":0.53611}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-28","epss":0.00715,"percentile":0.53611}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6605","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6605","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56866","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56866","date":"2026-10-28","epss":0.00473,"percentile":0.40832}],"risk":0.35475,"urls":["https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847306","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."},"relatedVulnerabilities":[{"id":"CVE-2026-56866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56866","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56866","date":"2026-10-28","epss":0.00473,"percentile":0.40832}],"urls":["https://go.dev/cl/847306","https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6605"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56866","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8194","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-8194","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-10-28","epss":0.00708,"percentile":0.53336}],"risk":0.35400000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8194"},"relatedVulnerabilities":[{"id":"CVE-2025-8194","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-10-28","epss":0.00708,"percentile":0.53336}],"urls":["https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1","https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38","https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227","https://github.com/python/cpython/issues/130577","https://github.com/python/cpython/pull/137027","https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/","http://www.openwall.com/lists/oss-security/2025/07/28/1","http://www.openwall.com/lists/oss-security/2025/07/28/2","https://github.com/python/cpython/pull/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/pull/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/pull/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/pull/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/pull/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/pull/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8194","description":"There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \n\nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1"}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8194","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-8194","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-10-28","epss":0.00708,"percentile":0.53336}],"risk":0.35400000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8194"},"relatedVulnerabilities":[{"id":"CVE-2025-8194","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-10-28","epss":0.00708,"percentile":0.53336}],"urls":["https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1","https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38","https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227","https://github.com/python/cpython/issues/130577","https://github.com/python/cpython/pull/137027","https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/","http://www.openwall.com/lists/oss-security/2025/07/28/1","http://www.openwall.com/lists/oss-security/2025/07/28/2","https://github.com/python/cpython/pull/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/pull/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/pull/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/pull/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/pull/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/pull/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8194","description":"There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \n\nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1"}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-8194","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-8194","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-10-28","epss":0.00708,"percentile":0.53336}],"risk":0.35400000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8194"},"relatedVulnerabilities":[{"id":"CVE-2025-8194","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-10-28","epss":0.00708,"percentile":0.53336}],"urls":["https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1","https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38","https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227","https://github.com/python/cpython/issues/130577","https://github.com/python/cpython/pull/137027","https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/","http://www.openwall.com/lists/oss-security/2025/07/28/1","http://www.openwall.com/lists/oss-security/2025/07/28/2","https://github.com/python/cpython/pull/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/pull/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/pull/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/pull/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/pull/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/pull/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8194","description":"There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \n\nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1"}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8194","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-8194","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-10-28","epss":0.00708,"percentile":0.53336}],"risk":0.35400000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8194"},"relatedVulnerabilities":[{"id":"CVE-2025-8194","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8194","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-8194","date":"2026-10-28","epss":0.00708,"percentile":0.53336}],"urls":["https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1","https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38","https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227","https://github.com/python/cpython/issues/130577","https://github.com/python/cpython/pull/137027","https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/","http://www.openwall.com/lists/oss-security/2025/07/28/1","http://www.openwall.com/lists/oss-security/2025/07/28/2","https://github.com/python/cpython/pull/57f5981d6260ed21266e0c26951b8564cc252bc2","https://github.com/python/cpython/pull/73f03e4808206f71eb6b92c579505a220942ef19","https://github.com/python/cpython/pull/b4ec17488eedec36d3c05fec127df71c0071f6cb","https://github.com/python/cpython/pull/c9d9f78feb1467e73fd29356c040bde1c104f29f","https://github.com/python/cpython/pull/cdae923ffe187d6ef916c0f665a31249619193fe","https://github.com/python/cpython/pull/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8194","description":"There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \n\nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1"}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4224","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4224","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-10-28","epss":0.00702,"percentile":0.53109}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4224"},"relatedVulnerabilities":[{"id":"CVE-2026-4224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-10-28","epss":0.00702,"percentile":0.53109}],"urls":["https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a","https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621","https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785","https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee","https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3","https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768","https://github.com/python/cpython/issues/145986","https://github.com/python/cpython/pull/145987","https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/","http://www.openwall.com/lists/oss-security/2026/03/16/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224","description":"When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4224","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4224","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-10-28","epss":0.00702,"percentile":0.53109}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4224"},"relatedVulnerabilities":[{"id":"CVE-2026-4224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-10-28","epss":0.00702,"percentile":0.53109}],"urls":["https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a","https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621","https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785","https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee","https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3","https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768","https://github.com/python/cpython/issues/145986","https://github.com/python/cpython/pull/145987","https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/","http://www.openwall.com/lists/oss-security/2026/03/16/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224","description":"When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4224","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4224","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-10-28","epss":0.00702,"percentile":0.53109}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4224"},"relatedVulnerabilities":[{"id":"CVE-2026-4224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-10-28","epss":0.00702,"percentile":0.53109}],"urls":["https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a","https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621","https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785","https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee","https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3","https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768","https://github.com/python/cpython/issues/145986","https://github.com/python/cpython/pull/145987","https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/","http://www.openwall.com/lists/oss-security/2026/03/16/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224","description":"When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4224","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4224","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-10-28","epss":0.00702,"percentile":0.53109}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4224"},"relatedVulnerabilities":[{"id":"CVE-2026-4224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-10-28","epss":0.00702,"percentile":0.53109}],"urls":["https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a","https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621","https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785","https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee","https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3","https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768","https://github.com/python/cpython/issues/145986","https://github.com/python/cpython/pull/145987","https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/","http://www.openwall.com/lists/oss-security/2026/03/16/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224","description":"When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs."}]},{"artifact":{"id":"34f967921c09dcd9","cpes":["cpe:2.3:a:curl:curl:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11856","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-11856","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-28","epss":0.00688,"percentile":0.52576}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11856"},"relatedVulnerabilities":[{"id":"CVE-2026-11856","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-28","epss":0.00688,"percentile":0.52576}],"urls":["https://curl.se/docs/CVE-2026-11856.html","https://curl.se/docs/CVE-2026-11856.json","https://hackerone.com/reports/3793260"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`."}]},{"artifact":{"id":"bf88a5f755934444","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11856","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-11856","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-28","epss":0.00688,"percentile":0.52576}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11856"},"relatedVulnerabilities":[{"id":"CVE-2026-11856","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-28","epss":0.00688,"percentile":0.52576}],"urls":["https://curl.se/docs/CVE-2026-11856.html","https://curl.se/docs/CVE-2026-11856.json","https://hackerone.com/reports/3793260"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`."}]},{"artifact":{"id":"25fcf12ace6abd0f","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11856","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-11856","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-28","epss":0.00688,"percentile":0.52576}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11856"},"relatedVulnerabilities":[{"id":"CVE-2026-11856","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-28","epss":0.00688,"percentile":0.52576}],"urls":["https://curl.se/docs/CVE-2026-11856.html","https://curl.se/docs/CVE-2026-11856.json","https://hackerone.com/reports/3793260"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4155","versionConstraint":"<1.24.11||>=1.25.0,<1.25.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4155","fix":{"state":"fixed","versions":["1.24.11","1.25.5"],"available":[{"date":"2025-12-02","kind":"release","version":"1.24.11"},{"date":"2025-12-02","kind":"release","version":"1.25.5"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61729","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61729","date":"2026-10-28","epss":0.00457,"percentile":0.39532}],"risk":0.34275,"urls":["https://go.dev/issue/76445","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/725920","description":"Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61729","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61729","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61729","date":"2026-10-28","epss":0.00457,"percentile":0.39532}],"urls":["https://go.dev/cl/725920","https://go.dev/issue/76445","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","https://pkg.go.dev/vuln/GO-2025-4155"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61729","description":"Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption."}]},{"artifact":{"id":"ff982be65dc32dfc","cpes":["cpe:2.3:a:libgcrypt20:libgcrypt20:1.8.5-5ubuntu1.1:*:*:*:*:*:*:*"],"name":"libgcrypt20","purl":"pkg:deb/ubuntu/libgcrypt20@1.8.5-5ubuntu1.1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.8.5-5ubuntu1.1","language":"","licenses":["sha256:8f11910ef604ead72fbdc0c0caa641e3f955f66c4868175310ed7290e32b0f37"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgcrypt20/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgcrypt20/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcrypt20:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgcrypt20:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-2236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libgcrypt20","version":"1.8.5-5ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2024-2236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2236","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-2236","date":"2026-10-28","epss":0.0114,"percentile":0.66504}],"risk":0.34199999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2236"},"relatedVulnerabilities":[{"id":"CVE-2024-2236","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2236","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-2236","date":"2026-10-28","epss":0.0114,"percentile":0.66504}],"urls":["https://access.redhat.com/errata/RHSA-2024:9404","https://access.redhat.com/errata/RHSA-2025:3530","https://access.redhat.com/errata/RHSA-2025:3534","https://access.redhat.com/security/cve/CVE-2024-2236","https://bugzilla.redhat.com/show_bug.cgi?id=2245218","https://bugzilla.redhat.com/show_bug.cgi?id=2268268","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2236","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts."}]},{"artifact":{"id":"68b2eaee91f56791","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.34-7ubuntu0.1?arch=amd64&distro=ubuntu-20.04&upstream=pcre2","type":"deb","version":"10.34-7ubuntu0.1","language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-41409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pcre2","version":"10.34-7ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-41409","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-10-28","epss":0.01121,"percentile":0.66074}],"risk":0.3363,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-41409"},"relatedVulnerabilities":[{"id":"CVE-2022-41409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-10-28","epss":0.01121,"percentile":0.66074}],"urls":["https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35","https://github.com/PCRE2Project/pcre2/issues/141"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41409","description":"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-28","epss":0.00672,"percentile":0.51912}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-28","epss":0.00672,"percentile":0.51912}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-28","epss":0.00672,"percentile":0.51912}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-28","epss":0.00672,"percentile":0.51912}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-28","epss":0.00672,"percentile":0.51912}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-28","epss":0.00672,"percentile":0.51912}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-28","epss":0.00672,"percentile":0.51912}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-28","epss":0.00672,"percentile":0.51912}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14831","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-14831","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14831","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-14831","date":"2026-10-28","epss":0.00666,"percentile":0.51682}],"risk":0.333,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14831"},"relatedVulnerabilities":[{"id":"CVE-2025-14831","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14831","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-14831","date":"2026-10-28","epss":0.00666,"percentile":0.51682}],"urls":["https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:3477","https://access.redhat.com/errata/RHSA-2026:4188","https://access.redhat.com/errata/RHSA-2026:4655","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:5585","https://access.redhat.com/errata/RHSA-2026:5606","https://access.redhat.com/errata/RHSA-2026:6618","https://access.redhat.com/errata/RHSA-2026:6630","https://access.redhat.com/errata/RHSA-2026:6737","https://access.redhat.com/errata/RHSA-2026:6738","https://access.redhat.com/errata/RHSA-2026:7329","https://access.redhat.com/errata/RHSA-2026:7335","https://access.redhat.com/errata/RHSA-2026:7477","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:8746","https://access.redhat.com/errata/RHSA-2026:8747","https://access.redhat.com/errata/RHSA-2026:8748","https://access.redhat.com/security/cve/CVE-2025-14831","https://bugzilla.redhat.com/show_bug.cgi?id=2423177","https://gitlab.com/gnutls/gnutls/-/issues/1773","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14831","description":"A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs)."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-28","epss":0.01104,"percentile":0.65657}],"risk":0.3312,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75806"},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-28","epss":0.01104,"percentile":0.65657}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-28","epss":0.01104,"percentile":0.65657}],"risk":0.3312,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75806"},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-28","epss":0.01104,"percentile":0.65657}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"bfe6694a44340acd","cpes":["cpe:2.3:a:libssh-4:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh-4:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*"],"name":"libssh-4","purl":"pkg:deb/ubuntu/libssh-4@0.9.3-2ubuntu2.5?arch=amd64&distro=ubuntu-20.04&upstream=libssh","type":"deb","version":"0.9.3-2ubuntu2.5","language":"","licenses":["BSD-2-clause","BSD-3-clause","LGPL-2.1","LGPL-2.1+~OpenSSL","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh-4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssh-4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3731","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libssh","version":"0.9.3-2ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3731","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3731","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-3731","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-3731","date":"2026-10-28","epss":0.00656,"percentile":0.5127}],"risk":0.328,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3731"},"relatedVulnerabilities":[{"id":"CVE-2026-3731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3731","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-3731","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-3731","date":"2026-10-28","epss":0.00656,"percentile":0.5127}],"urls":["https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60","https://vuldb.com/?ctiid.349709","https://vuldb.com/?id.349709","https://vuldb.com/?submit.767120","https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz","https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3731","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component."}]},{"artifact":{"id":"bf291b3ff1f0a486","cpes":["cpe:2.3:a:git:git:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A2.25.1-1ubuntu3.14?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1:2.25.1-1ubuntu3.14","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000021","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git","version":"1:2.25.1-1ubuntu3.14"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2018-1000021","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000021","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000021","date":"2026-10-28","epss":0.01074,"percentile":0.64827}],"risk":0.3222,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000021"},"relatedVulnerabilities":[{"id":"CVE-2018-1000021","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000021","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000021","date":"2026-10-28","epss":0.01074,"percentile":0.64827}],"urls":["http://www.batterystapl.es/2018/01/security-implications-of-ansi-escape.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000021","description":"GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack)."}]},{"artifact":{"id":"160f2ca74a1211ed","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A2.25.1-1ubuntu3.14?arch=all&distro=ubuntu-20.04&upstream=git","type":"deb","version":"1:2.25.1-1ubuntu3.14","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000021","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git","version":"1:2.25.1-1ubuntu3.14"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2018-1000021","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000021","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000021","date":"2026-10-28","epss":0.01074,"percentile":0.64827}],"risk":0.3222,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000021"},"relatedVulnerabilities":[{"id":"CVE-2018-1000021","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000021","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000021","date":"2026-10-28","epss":0.01074,"percentile":0.64827}],"urls":["http://www.batterystapl.es/2018/01/security-implications-of-ansi-escape.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000021","description":"GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack)."}]},{"artifact":{"id":"0173539095d733d0","cpes":["cpe:2.3:a:wget:wget:1.20.3-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/ubuntu/wget@1.20.3-1ubuntu2.1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.20.3-1ubuntu2.1","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-10524","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"wget","version":"1.20.3-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2024-10524","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10524","cwe":"CWE-918","type":"Secondary","source":"reefs@jfrog.com"}],"epss":[{"cve":"CVE-2024-10524","date":"2026-10-28","epss":0.01071,"percentile":0.64742}],"risk":0.32130000000000003,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10524"},"relatedVulnerabilities":[{"id":"CVE-2024-10524","cvss":[{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":3.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10524","cwe":"CWE-918","type":"Secondary","source":"reefs@jfrog.com"}],"epss":[{"cve":"CVE-2024-10524","date":"2026-10-28","epss":0.01071,"percentile":0.64742}],"urls":["https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778","https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/","https://seclists.org/oss-sec/2024/q4/107","http://www.openwall.com/lists/oss-security/2024/11/18/6","https://security.netapp.com/advisory/ntap-20250321-0007/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10524","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-20230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2017-20230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-10-28","epss":0.00641,"percentile":0.50578}],"risk":0.3205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-20230"},"relatedVulnerabilities":[{"id":"CVE-2017-20230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-10-28","epss":0.00641,"percentile":0.50578}],"urls":["https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch","https://github.com/Perl/perl5/issues/15831","https://metacpan.org/release/RURBAN/Storable-3.05/changes","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html","http://www.openwall.com/lists/oss-security/2026/04/21/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-20230","description":"Storable versions before 3.05 for Perl has a stack overflow.\n\nThe retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-20230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2017-20230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-10-28","epss":0.00641,"percentile":0.50578}],"risk":0.3205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-20230"},"relatedVulnerabilities":[{"id":"CVE-2017-20230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-10-28","epss":0.00641,"percentile":0.50578}],"urls":["https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch","https://github.com/Perl/perl5/issues/15831","https://metacpan.org/release/RURBAN/Storable-3.05/changes","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html","http://www.openwall.com/lists/oss-security/2026/04/21/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-20230","description":"Storable versions before 3.05 for Perl has a stack overflow.\n\nThe retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-20230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2017-20230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-10-28","epss":0.00641,"percentile":0.50578}],"risk":0.3205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-20230"},"relatedVulnerabilities":[{"id":"CVE-2017-20230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-10-28","epss":0.00641,"percentile":0.50578}],"urls":["https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch","https://github.com/Perl/perl5/issues/15831","https://metacpan.org/release/RURBAN/Storable-3.05/changes","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html","http://www.openwall.com/lists/oss-security/2026/04/21/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-20230","description":"Storable versions before 3.05 for Perl has a stack overflow.\n\nThe retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-20230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2017-20230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-10-28","epss":0.00641,"percentile":0.50578}],"risk":0.3205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-20230"},"relatedVulnerabilities":[{"id":"CVE-2017-20230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-10-28","epss":0.00641,"percentile":0.50578}],"urls":["https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch","https://github.com/Perl/perl5/issues/15831","https://metacpan.org/release/RURBAN/Storable-3.05/changes","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html","http://www.openwall.com/lists/oss-security/2026/04/21/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-20230","description":"Storable versions before 3.05 for Perl has a stack overflow.\n\nThe retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6610","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78660","date":"2026-10-28","epss":0.00425,"percentile":0.36702}],"risk":0.31875000000000003,"urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/835145","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."},"relatedVulnerabilities":[{"id":"CVE-2026-78660","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78660","date":"2026-10-28","epss":0.00425,"percentile":0.36702}],"urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15308","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-15308","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-28","epss":0.00637,"percentile":0.50385}],"risk":0.3185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15308"},"relatedVulnerabilities":[{"id":"CVE-2026-15308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-28","epss":0.00637,"percentile":0.50385}],"urls":["https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9","https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7","https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14","https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced","https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606","https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00","https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd","https://github.com/python/cpython/issues/153030","https://github.com/python/cpython/pull/153031","https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/","http://www.openwall.com/lists/oss-security/2026/07/09/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15308","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15308","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-15308","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-28","epss":0.00637,"percentile":0.50385}],"risk":0.3185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15308"},"relatedVulnerabilities":[{"id":"CVE-2026-15308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-28","epss":0.00637,"percentile":0.50385}],"urls":["https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9","https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7","https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14","https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced","https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606","https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00","https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd","https://github.com/python/cpython/issues/153030","https://github.com/python/cpython/pull/153031","https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/","http://www.openwall.com/lists/oss-security/2026/07/09/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15308","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15308","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-15308","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-28","epss":0.00637,"percentile":0.50385}],"risk":0.3185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15308"},"relatedVulnerabilities":[{"id":"CVE-2026-15308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-28","epss":0.00637,"percentile":0.50385}],"urls":["https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9","https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7","https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14","https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced","https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606","https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00","https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd","https://github.com/python/cpython/issues/153030","https://github.com/python/cpython/pull/153031","https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/","http://www.openwall.com/lists/oss-security/2026/07/09/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15308","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15308","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-15308","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-28","epss":0.00637,"percentile":0.50385}],"risk":0.3185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15308"},"relatedVulnerabilities":[{"id":"CVE-2026-15308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15308","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15308","date":"2026-10-28","epss":0.00637,"percentile":0.50385}],"urls":["https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9","https://github.com/python/cpython/commit/1e7956f1a722df9aabc509c30f8fbdc3a2b4fdc7","https://github.com/python/cpython/commit/785df8f743800661961528970f8598edcd291c14","https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced","https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606","https://github.com/python/cpython/commit/c2390b9376e35a701ed3acc597b8fc87546c9b00","https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd","https://github.com/python/cpython/issues/153030","https://github.com/python/cpython/pull/153031","https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/","http://www.openwall.com/lists/oss-security/2026/07/09/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15308","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU\ndenial-of-service through repeated unterminated markup declarations when\nprocessing uncontrolled data."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42766","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-10-28","epss":0.0106,"percentile":0.64421}],"risk":0.318,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42766"},"relatedVulnerabilities":[{"id":"CVE-2026-42766","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-10-28","epss":0.0106,"percentile":0.64421}],"urls":["https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce","https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4","https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7","https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4","https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","description":"Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42766","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-10-28","epss":0.0106,"percentile":0.64421}],"risk":0.318,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42766"},"relatedVulnerabilities":[{"id":"CVE-2026-42766","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-10-28","epss":0.0106,"percentile":0.64421}],"urls":["https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce","https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4","https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7","https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4","https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","description":"Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-3956","versionConstraint":"<1.23.12||>=1.24.0,<1.24.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-3956","fix":{"state":"fixed","versions":["1.23.12","1.24.6"],"available":[{"date":"2025-08-06","kind":"release","version":"1.23.12"},{"date":"2025-08-06","kind":"release","version":"1.24.6"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47906","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-47906","date":"2026-10-28","epss":0.0055,"percentile":0.45891}],"risk":0.31625,"urls":["https://go.dev/issue/74466","https://groups.google.com/g/golang-announce/c/x5MKroML2yM"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/691775","description":"If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\"\", \".\", and \"..\"), can result in the binaries listed in the PATH being unexpectedly returned."},"relatedVulnerabilities":[{"id":"CVE-2025-47906","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47906","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-47906","date":"2026-10-28","epss":0.0055,"percentile":0.45891}],"urls":["https://go.dev/cl/691775","https://go.dev/issue/74466","https://groups.google.com/g/golang-announce/c/x5MKroML2yM","https://pkg.go.dev/vuln/GO-2025-3956","http://www.openwall.com/lists/oss-security/2025/08/06/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47906","description":"If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\"\", \".\", and \"..\"), can result in the binaries listed in the PATH being unexpectedly returned."}]},{"artifact":{"id":"5e3f99daab9a1514","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:245.4-4ubuntu3.24:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/ubuntu/libsystemd0@245.4-4ubuntu3.24?arch=amd64&distro=ubuntu-20.04&upstream=systemd","type":"deb","version":"245.4-4ubuntu3.24","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-26604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"systemd","version":"245.4-4ubuntu3.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-26604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-26604","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-26604","date":"2026-10-28","epss":0.01051,"percentile":0.64171}],"risk":0.3153,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-26604"},"relatedVulnerabilities":[{"id":"CVE-2023-26604","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-26604","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-26604","date":"2026-10-28","epss":0.01051,"percentile":0.64171}],"urls":["http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html","https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/","https://github.com/systemd/systemd/blob/main/NEWS#L4335-L4340","https://lists.debian.org/debian-lts-announce/2023/03/msg00032.html","https://medium.com/%40zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7","https://security.netapp.com/advisory/ntap-20230505-0009/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-26604","description":"systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the \"systemctl status\" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output."}]},{"artifact":{"id":"7fb6e4c8e297c76a","cpes":["cpe:2.3:a:libudev1:libudev1:245.4-4ubuntu3.24:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@245.4-4ubuntu3.24?arch=amd64&distro=ubuntu-20.04&upstream=systemd","type":"deb","version":"245.4-4ubuntu3.24","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-26604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"systemd","version":"245.4-4ubuntu3.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-26604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-26604","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-26604","date":"2026-10-28","epss":0.01051,"percentile":0.64171}],"risk":0.3153,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-26604"},"relatedVulnerabilities":[{"id":"CVE-2023-26604","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-26604","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-26604","date":"2026-10-28","epss":0.01051,"percentile":0.64171}],"urls":["http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html","https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/","https://github.com/systemd/systemd/blob/main/NEWS#L4335-L4340","https://lists.debian.org/debian-lts-announce/2023/03/msg00032.html","https://medium.com/%40zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7","https://security.netapp.com/advisory/ntap-20230505-0009/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-26604","description":"systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the \"systemctl status\" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-3373","versionConstraint":"<1.22.11||>=1.23.0-0,<1.23.5||>=1.24.0-0,<1.24.0-rc.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-3373","fix":{"state":"fixed","versions":["1.22.11","1.23.5","1.24.0-rc.2"],"available":[{"date":"2025-01-16","kind":"release","version":"1.22.11"},{"date":"2025-01-16","kind":"release","version":"1.23.5"},{"date":"2025-01-16","kind":"release","version":"1.24.0-rc.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45341","date":"2026-10-28","epss":0.00568,"percentile":0.46926}],"risk":0.31523999999999996,"urls":["https://go.dev/issue/71156","https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ","https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/643099","description":"A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain.\n\nCertificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs."},"relatedVulnerabilities":[{"id":"CVE-2024-45341","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45341","date":"2026-10-28","epss":0.00568,"percentile":0.46926}],"urls":["https://go.dev/cl/643099","https://go.dev/issue/71156","https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ","https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ","https://pkg.go.dev/vuln/GO-2025-3373","https://security.netapp.com/advisory/ntap-20250221-0004/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45341","description":"A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-28","epss":0.0063,"percentile":0.50036}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-28","epss":0.0063,"percentile":0.50036}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-28","epss":0.0063,"percentile":0.50036}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-28","epss":0.0063,"percentile":0.50036}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-28","epss":0.0063,"percentile":0.50036}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-28","epss":0.0063,"percentile":0.50036}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-28","epss":0.0063,"percentile":0.50036}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-28","epss":0.0063,"percentile":0.50036}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"90f01f5eff81b5a4","cpes":["cpe:2.3:a:libncurses6:libncurses6:6.2-0ubuntu2.1:*:*:*:*:*:*:*"],"name":"libncurses6","purl":"pkg:deb/ubuntu/libncurses6@6.2-0ubuntu2.1?arch=amd64&distro=ubuntu-20.04&upstream=ncurses","type":"deb","version":"6.2-0ubuntu2.1","language":"","licenses":["sha256:dced00c014dbe91a9179d6d92497d04c225c613cab85ba704aaa987369eadae3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libncurses6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libncurses6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"ncurses","version":"6.2-0ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-28","epss":0.01037,"percentile":0.63798}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-28","epss":0.01037,"percentile":0.63798}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"e32f4840d075659e","cpes":["cpe:2.3:a:libncursesw6:libncursesw6:6.2-0ubuntu2.1:*:*:*:*:*:*:*"],"name":"libncursesw6","purl":"pkg:deb/ubuntu/libncursesw6@6.2-0ubuntu2.1?arch=amd64&distro=ubuntu-20.04&upstream=ncurses","type":"deb","version":"6.2-0ubuntu2.1","language":"","licenses":["sha256:dced00c014dbe91a9179d6d92497d04c225c613cab85ba704aaa987369eadae3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libncursesw6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"ncurses","version":"6.2-0ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-28","epss":0.01037,"percentile":0.63798}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-28","epss":0.01037,"percentile":0.63798}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"c0e8162ddfa39d24","cpes":["cpe:2.3:a:libtinfo6:libtinfo6:6.2-0ubuntu2.1:*:*:*:*:*:*:*"],"name":"libtinfo6","purl":"pkg:deb/ubuntu/libtinfo6@6.2-0ubuntu2.1?arch=amd64&distro=ubuntu-20.04&upstream=ncurses","type":"deb","version":"6.2-0ubuntu2.1","language":"","licenses":["sha256:dced00c014dbe91a9179d6d92497d04c225c613cab85ba704aaa987369eadae3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libtinfo6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"ncurses","version":"6.2-0ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-28","epss":0.01037,"percentile":0.63798}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-28","epss":0.01037,"percentile":0.63798}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"d216f520e408f718","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.2-0ubuntu2.1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/ubuntu/ncurses-base@6.2-0ubuntu2.1?arch=all&distro=ubuntu-20.04&upstream=ncurses","type":"deb","version":"6.2-0ubuntu2.1","language":"","licenses":["sha256:dced00c014dbe91a9179d6d92497d04c225c613cab85ba704aaa987369eadae3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"ncurses","version":"6.2-0ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-28","epss":0.01037,"percentile":0.63798}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-28","epss":0.01037,"percentile":0.63798}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"84cc756d53f210c6","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:6.2-0ubuntu2.1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/ubuntu/ncurses-bin@6.2-0ubuntu2.1?arch=amd64&distro=ubuntu-20.04&upstream=ncurses","type":"deb","version":"6.2-0ubuntu2.1","language":"","licenses":["sha256:dced00c014dbe91a9179d6d92497d04c225c613cab85ba704aaa987369eadae3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"ncurses","version":"6.2-0ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-28","epss":0.01037,"percentile":0.63798}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-10-28","epss":0.01037,"percentile":0.63798}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"d466610980c64a4f","cpes":["cpe:2.3:a:gcc-10-base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10-base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"gcc-10-base","purl":"pkg:deb/ubuntu/gcc-10-base@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/gcc-10-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-4039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-4039","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-4039","cwe":"CWE-693","type":"Secondary","source":"arm-security@arm.com"},{"cve":"CVE-2023-4039","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4039","date":"2026-10-28","epss":0.01036,"percentile":0.63783}],"risk":0.31079999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-4039"},"relatedVulnerabilities":[{"id":"CVE-2023-4039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"arm-security@arm.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4039","cwe":"CWE-693","type":"Secondary","source":"arm-security@arm.com"},{"cve":"CVE-2023-4039","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4039","date":"2026-10-28","epss":0.01036,"percentile":0.63783}],"urls":["https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64","https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4039","description":"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself."}]},{"artifact":{"id":"ab4c954aa38d7cce","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-4039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-4039","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-4039","cwe":"CWE-693","type":"Secondary","source":"arm-security@arm.com"},{"cve":"CVE-2023-4039","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4039","date":"2026-10-28","epss":0.01036,"percentile":0.63783}],"risk":0.31079999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-4039"},"relatedVulnerabilities":[{"id":"CVE-2023-4039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"arm-security@arm.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4039","cwe":"CWE-693","type":"Secondary","source":"arm-security@arm.com"},{"cve":"CVE-2023-4039","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4039","date":"2026-10-28","epss":0.01036,"percentile":0.63783}],"urls":["https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64","https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4039","description":"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself."}]},{"artifact":{"id":"4b8e34f972831b96","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-4039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-4039","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-4039","cwe":"CWE-693","type":"Secondary","source":"arm-security@arm.com"},{"cve":"CVE-2023-4039","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4039","date":"2026-10-28","epss":0.01036,"percentile":0.63783}],"risk":0.31079999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-4039"},"relatedVulnerabilities":[{"id":"CVE-2023-4039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"arm-security@arm.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4039","cwe":"CWE-693","type":"Secondary","source":"arm-security@arm.com"},{"cve":"CVE-2023-4039","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4039","date":"2026-10-28","epss":0.01036,"percentile":0.63783}],"urls":["https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64","https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4039","description":"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6613","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6613","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94439","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94439","date":"2026-10-28","epss":0.00414,"percentile":0.35636}],"risk":0.31049999999999994,"urls":["https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847311","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.\n\nThe impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."},"relatedVulnerabilities":[{"id":"CVE-2026-94439","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94439","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94439","date":"2026-10-28","epss":0.00414,"percentile":0.35636}],"urls":["https://go.dev/cl/847311","https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6613"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94439","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39881","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-39881","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-39881","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39881","date":"2026-10-28","epss":0.0062,"percentile":0.49566}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-39881"},"relatedVulnerabilities":[{"id":"CVE-2026-39881","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39881","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39881","date":"2026-10-28","epss":0.0062,"percentile":0.49566}],"urls":["https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19","https://github.com/vim/vim/releases/tag/v9.2.0316","https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39881","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39881","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-39881","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-39881","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39881","date":"2026-10-28","epss":0.0062,"percentile":0.49566}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-39881"},"relatedVulnerabilities":[{"id":"CVE-2026-39881","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39881","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39881","date":"2026-10-28","epss":0.0062,"percentile":0.49566}],"urls":["https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19","https://github.com/vim/vim/releases/tag/v9.2.0316","https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39881","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39881","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-39881","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-39881","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39881","date":"2026-10-28","epss":0.0062,"percentile":0.49566}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-39881"},"relatedVulnerabilities":[{"id":"CVE-2026-39881","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39881","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39881","date":"2026-10-28","epss":0.0062,"percentile":0.49566}],"urls":["https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19","https://github.com/vim/vim/releases/tag/v9.2.0316","https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39881","description":"Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316."}]},{"artifact":{"id":"fd6ba8236976331d","cpes":["cpe:2.3:a:gzip:gzip:1.10-0ubuntu4.1:*:*:*:*:*:*:*"],"name":"gzip","purl":"pkg:deb/ubuntu/gzip@1.10-0ubuntu4.1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.10-0ubuntu4.1","language":"","licenses":["sha256:f9ac4a5d7a670e3891881a2cdba5fa2cd625c4d58eae4a7aa372ac00a06803bd"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gzip/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/gzip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gzip.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/gzip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gzip.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/gzip.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-41992","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gzip","version":"1.10-0ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-41992","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-41992","cwe":"CWE-126","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-41992","date":"2026-10-28","epss":0.0062,"percentile":0.49535}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-41992"},"relatedVulnerabilities":[{"id":"CVE-2026-41992","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41992","cwe":"CWE-126","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-41992","date":"2026-10-28","epss":0.0062,"percentile":0.49535}],"urls":["https://cert.pl/en/posts/2026/04/CVE-2026-41991/","https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681","https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d","https://www.gnu.org/software/gzip/","http://www.openwall.com/lists/oss-security/2026/08/23/1","http://www.openwall.com/lists/oss-security/2026/08/25/1","http://www.openwall.com/lists/oss-security/2026/08/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41992","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d."}]},{"artifact":{"id":"9ad028a9a47a9fb7","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0915","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0915","date":"2026-10-28","epss":0.00618,"percentile":0.49473}],"risk":0.309,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0915"},"relatedVulnerabilities":[{"id":"CVE-2026-0915","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0915","date":"2026-10-28","epss":0.00618,"percentile":0.49473}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33802","http://www.openwall.com/lists/oss-security/2026/01/16/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0915","description":"Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver."}]},{"artifact":{"id":"c4143394e9032e2d","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0915","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0915","date":"2026-10-28","epss":0.00618,"percentile":0.49473}],"risk":0.309,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0915"},"relatedVulnerabilities":[{"id":"CVE-2026-0915","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0915","date":"2026-10-28","epss":0.00618,"percentile":0.49473}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33802","http://www.openwall.com/lists/oss-security/2026/01/16/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0915","description":"Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver."}]},{"artifact":{"id":"8cb74e3775c9e438","cpes":["cpe:2.3:a:locales:locales:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.31-0ubuntu9.18?arch=all&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0915","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0915","date":"2026-10-28","epss":0.00618,"percentile":0.49473}],"risk":0.309,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0915"},"relatedVulnerabilities":[{"id":"CVE-2026-0915","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0915","date":"2026-10-28","epss":0.00618,"percentile":0.49473}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33802","http://www.openwall.com/lists/oss-security/2026/01/16/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0915","description":"Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver."}]},{"artifact":{"id":"12308dd4ba29a3f4","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A8.2p1-4ubuntu0.13?arch=amd64&distro=ubuntu-20.04&upstream=openssh","type":"deb","version":"1:8.2p1-4ubuntu0.13","language":"","licenses":["BSD-2-clause","BSD-3-clause","Beer-ware","Expat-with-advertising-restriction","Mazieres-BSD-style","OpenSSH","Powell-BSD-style","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.preinst"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60000","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssh","version":"1:8.2p1-4ubuntu0.13"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60000","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60000","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-60000","date":"2026-10-28","epss":0.00618,"percentile":0.49467}],"risk":0.309,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60000"},"relatedVulnerabilities":[{"id":"CVE-2026-60000","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60000","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-60000","date":"2026-10-28","epss":0.00618,"percentile":0.49467}],"urls":["https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2","https://www.openssh.org/releasenotes.html#10.4p1","https://www.openwall.com/lists/oss-security/2026/07/06/5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60000","description":"sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11468","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-11468","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-10-28","epss":0.00616,"percentile":0.49339}],"risk":0.308,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-11468"},"relatedVulnerabilities":[{"id":"CVE-2025-11468","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-10-28","epss":0.00616,"percentile":0.49339}],"urls":["https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094","https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2","https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6","https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66","https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0","https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796","https://github.com/python/cpython/issues/143935","https://github.com/python/cpython/pull/143936","https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11468","description":"When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11468","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-11468","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-10-28","epss":0.00616,"percentile":0.49339}],"risk":0.308,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-11468"},"relatedVulnerabilities":[{"id":"CVE-2025-11468","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-10-28","epss":0.00616,"percentile":0.49339}],"urls":["https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094","https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2","https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6","https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66","https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0","https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796","https://github.com/python/cpython/issues/143935","https://github.com/python/cpython/pull/143936","https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11468","description":"When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-11468","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-11468","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-10-28","epss":0.00616,"percentile":0.49339}],"risk":0.308,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-11468"},"relatedVulnerabilities":[{"id":"CVE-2025-11468","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-10-28","epss":0.00616,"percentile":0.49339}],"urls":["https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094","https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2","https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6","https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66","https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0","https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796","https://github.com/python/cpython/issues/143935","https://github.com/python/cpython/pull/143936","https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11468","description":"When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11468","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-11468","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-10-28","epss":0.00616,"percentile":0.49339}],"risk":0.308,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-11468"},"relatedVulnerabilities":[{"id":"CVE-2025-11468","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-10-28","epss":0.00616,"percentile":0.49339}],"urls":["https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094","https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2","https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6","https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66","https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0","https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796","https://github.com/python/cpython/issues/143935","https://github.com/python/cpython/pull/143936","https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11468","description":"When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-34180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-10-28","epss":0.01025,"percentile":0.63469}],"risk":0.3075,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34180"},"relatedVulnerabilities":[{"id":"CVE-2026-34180","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-10-28","epss":0.01025,"percentile":0.63469}],"urls":["https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d","https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83","https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff","https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43","https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","description":"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer.  More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-34180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-34180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-10-28","epss":0.01025,"percentile":0.63469}],"risk":0.3075,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34180"},"relatedVulnerabilities":[{"id":"CVE-2026-34180","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-10-28","epss":0.01025,"percentile":0.63469}],"urls":["https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d","https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83","https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff","https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43","https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","description":"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer.  More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"bf291b3ff1f0a486","cpes":["cpe:2.3:a:git:git:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A2.25.1-1ubuntu3.14?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1:2.25.1-1ubuntu3.14","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-46835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git","version":"1:2.25.1-1ubuntu3.14"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-46835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-46835","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-46835","date":"2026-10-28","epss":0.00612,"percentile":0.49171}],"risk":0.306,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-46835"},"relatedVulnerabilities":[{"id":"CVE-2025-46835","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","metrics":{"baseScore":8.5,"impactScore":6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-46835","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-46835","date":"2026-10-28","epss":0.00612,"percentile":0.49171}],"urls":["https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a437f5bc93330a70b42a230e52f3bd036ca1b1da","https://github.com/j6t/git-gui/security/advisories/GHSA-xfx7-68v4-v8fg","http://www.openwall.com/lists/oss-security/2025/07/08/4","https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-46835","description":"Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1."}]},{"artifact":{"id":"160f2ca74a1211ed","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A2.25.1-1ubuntu3.14?arch=all&distro=ubuntu-20.04&upstream=git","type":"deb","version":"1:2.25.1-1ubuntu3.14","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-46835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git","version":"1:2.25.1-1ubuntu3.14"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-46835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-46835","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-46835","date":"2026-10-28","epss":0.00612,"percentile":0.49171}],"risk":0.306,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-46835"},"relatedVulnerabilities":[{"id":"CVE-2025-46835","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","metrics":{"baseScore":8.5,"impactScore":6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-46835","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-46835","date":"2026-10-28","epss":0.00612,"percentile":0.49171}],"urls":["https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a437f5bc93330a70b42a230e52f3bd036ca1b1da","https://github.com/j6t/git-gui/security/advisories/GHSA-xfx7-68v4-v8fg","http://www.openwall.com/lists/oss-security/2025/07/08/4","https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-46835","description":"Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4007","versionConstraint":"<1.24.9||>=1.25.0,<1.25.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4007","fix":{"state":"fixed","versions":["1.24.9","1.25.3"],"available":[{"date":"2025-10-13","kind":"release","version":"1.24.9"},{"date":"2025-10-13","kind":"release","version":"1.25.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58187","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58187","date":"2026-10-28","epss":0.00406,"percentile":0.34747}],"risk":0.3045,"urls":["https://go.dev/cl/709854","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75681","description":"Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate.\n\nThis affects programs which validate arbitrary certificate chains."},"relatedVulnerabilities":[{"id":"CVE-2025-58187","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58187","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58187","date":"2026-10-28","epss":0.00406,"percentile":0.34747}],"urls":["https://go.dev/cl/709854","https://go.dev/issue/75681","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4007","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58187","description":"Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-28","epss":0.00609,"percentile":0.49031}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-28","epss":0.00609,"percentile":0.49031}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-28","epss":0.00609,"percentile":0.49031}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-28","epss":0.00609,"percentile":0.49031}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-28","epss":0.00609,"percentile":0.49031}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-28","epss":0.00609,"percentile":0.49031}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-28","epss":0.00609,"percentile":0.49031}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-10-28","epss":0.00609,"percentile":0.49031}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6069","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6069","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-10-28","epss":0.00603,"percentile":0.48715}],"risk":0.3015,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6069"},"relatedVulnerabilities":[{"id":"CVE-2025-6069","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-10-28","epss":0.00603,"percentile":0.48715}],"urls":["https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949","https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41","https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49","https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5","https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b","https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc","https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15","https://github.com/python/cpython/issues/135462","https://github.com/python/cpython/pull/135464","https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6069","description":"The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6069","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6069","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-10-28","epss":0.00603,"percentile":0.48715}],"risk":0.3015,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6069"},"relatedVulnerabilities":[{"id":"CVE-2025-6069","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-10-28","epss":0.00603,"percentile":0.48715}],"urls":["https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949","https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41","https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49","https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5","https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b","https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc","https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15","https://github.com/python/cpython/issues/135462","https://github.com/python/cpython/pull/135464","https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6069","description":"The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-6069","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6069","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-10-28","epss":0.00603,"percentile":0.48715}],"risk":0.3015,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6069"},"relatedVulnerabilities":[{"id":"CVE-2025-6069","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-10-28","epss":0.00603,"percentile":0.48715}],"urls":["https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949","https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41","https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49","https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5","https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b","https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc","https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15","https://github.com/python/cpython/issues/135462","https://github.com/python/cpython/pull/135464","https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6069","description":"The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6069","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6069","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-10-28","epss":0.00603,"percentile":0.48715}],"risk":0.3015,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6069"},"relatedVulnerabilities":[{"id":"CVE-2025-6069","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-10-28","epss":0.00603,"percentile":0.48715}],"urls":["https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949","https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41","https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49","https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5","https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b","https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc","https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15","https://github.com/python/cpython/issues/135462","https://github.com/python/cpython/pull/135464","https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6069","description":"The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69534","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69534","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69534","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-69534","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-69534","date":"2026-10-28","epss":0.00602,"percentile":0.48634}],"risk":0.301,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69534"},"relatedVulnerabilities":[{"id":"CVE-2025-69534","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69534","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-69534","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-69534","date":"2026-10-28","epss":0.00602,"percentile":0.48634}],"urls":["https://github.com/Python-Markdown/markdown","https://github.com/Python-Markdown/markdown/actions/runs/15736122892","https://github.com/Python-Markdown/markdown/issues/1534","http://www.openwall.com/lists/oss-security/2026/03/06/4","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13508","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14835","https://access.redhat.com/errata/RHSA-2026:14873","https://access.redhat.com/errata/RHSA-2026:14874","https://access.redhat.com/errata/RHSA-2026:19155","https://access.redhat.com/errata/RHSA-2026:19366","https://access.redhat.com/errata/RHSA-2026:20674","https://access.redhat.com/errata/RHSA-2026:20676","https://access.redhat.com/errata/RHSA-2026:20677","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69534","https://bugzilla.redhat.com/show_bug.cgi?id=2444839","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69534.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69534","description":"Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69534","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69534","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69534","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-69534","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-69534","date":"2026-10-28","epss":0.00602,"percentile":0.48634}],"risk":0.301,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69534"},"relatedVulnerabilities":[{"id":"CVE-2025-69534","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69534","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-69534","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-69534","date":"2026-10-28","epss":0.00602,"percentile":0.48634}],"urls":["https://github.com/Python-Markdown/markdown","https://github.com/Python-Markdown/markdown/actions/runs/15736122892","https://github.com/Python-Markdown/markdown/issues/1534","http://www.openwall.com/lists/oss-security/2026/03/06/4","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13508","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14835","https://access.redhat.com/errata/RHSA-2026:14873","https://access.redhat.com/errata/RHSA-2026:14874","https://access.redhat.com/errata/RHSA-2026:19155","https://access.redhat.com/errata/RHSA-2026:19366","https://access.redhat.com/errata/RHSA-2026:20674","https://access.redhat.com/errata/RHSA-2026:20676","https://access.redhat.com/errata/RHSA-2026:20677","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69534","https://bugzilla.redhat.com/show_bug.cgi?id=2444839","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69534.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69534","description":"Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-69534","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69534","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69534","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-69534","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-69534","date":"2026-10-28","epss":0.00602,"percentile":0.48634}],"risk":0.301,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69534"},"relatedVulnerabilities":[{"id":"CVE-2025-69534","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69534","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-69534","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-69534","date":"2026-10-28","epss":0.00602,"percentile":0.48634}],"urls":["https://github.com/Python-Markdown/markdown","https://github.com/Python-Markdown/markdown/actions/runs/15736122892","https://github.com/Python-Markdown/markdown/issues/1534","http://www.openwall.com/lists/oss-security/2026/03/06/4","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13508","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14835","https://access.redhat.com/errata/RHSA-2026:14873","https://access.redhat.com/errata/RHSA-2026:14874","https://access.redhat.com/errata/RHSA-2026:19155","https://access.redhat.com/errata/RHSA-2026:19366","https://access.redhat.com/errata/RHSA-2026:20674","https://access.redhat.com/errata/RHSA-2026:20676","https://access.redhat.com/errata/RHSA-2026:20677","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69534","https://bugzilla.redhat.com/show_bug.cgi?id=2444839","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69534.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69534","description":"Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69534","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69534","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69534","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-69534","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-69534","date":"2026-10-28","epss":0.00602,"percentile":0.48634}],"risk":0.301,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69534"},"relatedVulnerabilities":[{"id":"CVE-2025-69534","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69534","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-69534","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-69534","date":"2026-10-28","epss":0.00602,"percentile":0.48634}],"urls":["https://github.com/Python-Markdown/markdown","https://github.com/Python-Markdown/markdown/actions/runs/15736122892","https://github.com/Python-Markdown/markdown/issues/1534","http://www.openwall.com/lists/oss-security/2026/03/06/4","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:13508","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14835","https://access.redhat.com/errata/RHSA-2026:14873","https://access.redhat.com/errata/RHSA-2026:14874","https://access.redhat.com/errata/RHSA-2026:19155","https://access.redhat.com/errata/RHSA-2026:19366","https://access.redhat.com/errata/RHSA-2026:20674","https://access.redhat.com/errata/RHSA-2026:20676","https://access.redhat.com/errata/RHSA-2026:20677","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69534","https://bugzilla.redhat.com/show_bug.cgi?id=2444839","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69534.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69534","description":"Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions."}]},{"artifact":{"id":"bf291b3ff1f0a486","cpes":["cpe:2.3:a:git:git:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A2.25.1-1ubuntu3.14?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1:2.25.1-1ubuntu3.14","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-27613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git","version":"1:2.25.1-1ubuntu3.14"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-27613","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-27613","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-27613","date":"2026-10-28","epss":0.00601,"percentile":0.4861}],"risk":0.3005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-27613"},"relatedVulnerabilities":[{"id":"CVE-2025-27613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27613","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-27613","date":"2026-10-28","epss":0.00601,"percentile":0.4861}],"urls":["https://github.com/j6t/gitk/compare/465f03869ae11acd04abfa1b83c67879c867410c..026c397d911cde55924d7eb1311d0fd6e2e105d5","https://github.com/j6t/gitk/compare/7dd272eca153058da2e8d5b9960bbbf0b4f0cbaa..67a128b91e25978a15f9f7e194d81b441d603652","https://github.com/j6t/gitk/security/advisories/GHSA-f3cw-xrj3-wr2v","http://www.openwall.com/lists/oss-security/2025/07/08/4","https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27613","description":"Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1."}]},{"artifact":{"id":"160f2ca74a1211ed","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A2.25.1-1ubuntu3.14?arch=all&distro=ubuntu-20.04&upstream=git","type":"deb","version":"1:2.25.1-1ubuntu3.14","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-27613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git","version":"1:2.25.1-1ubuntu3.14"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-27613","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-27613","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-27613","date":"2026-10-28","epss":0.00601,"percentile":0.4861}],"risk":0.3005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-27613"},"relatedVulnerabilities":[{"id":"CVE-2025-27613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27613","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-27613","date":"2026-10-28","epss":0.00601,"percentile":0.4861}],"urls":["https://github.com/j6t/gitk/compare/465f03869ae11acd04abfa1b83c67879c867410c..026c397d911cde55924d7eb1311d0fd6e2e105d5","https://github.com/j6t/gitk/compare/7dd272eca153058da2e8d5b9960bbbf0b4f0cbaa..67a128b91e25978a15f9f7e194d81b441d603652","https://github.com/j6t/gitk/security/advisories/GHSA-f3cw-xrj3-wr2v","http://www.openwall.com/lists/oss-security/2025/07/08/4","https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27613","description":"Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6218","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6218","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56860","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56860","date":"2026-10-28","epss":0.0055,"percentile":0.45906}],"risk":0.29975,"urls":["https://go.dev/issue/80494","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/803681","description":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.\n\nNow, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations."},"relatedVulnerabilities":[{"id":"CVE-2026-56860","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56860","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56860","date":"2026-10-28","epss":0.0055,"percentile":0.45906}],"urls":["https://go.dev/cl/803681","https://go.dev/issue/80494","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6218"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","description":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations."}]},{"artifact":{"id":"9ad028a9a47a9fb7","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.31-0ubuntu9.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4802","versionConstraint":"< 2.31-0ubuntu9.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-4802","fix":{"state":"fixed","versions":["2.31-0ubuntu9.18"],"available":[{"date":"2025-05-28","kind":"advisory","version":"2.31-0ubuntu9.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-4802","cwe":"CWE-426","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-4802","date":"2026-10-28","epss":0.00593,"percentile":0.48216}],"risk":0.29650000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4802"},"relatedVulnerabilities":[{"id":"CVE-2025-4802","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4802","cwe":"CWE-426","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-4802","date":"2026-10-28","epss":0.00593,"percentile":0.48216}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=32976","https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e","http://www.openwall.com/lists/oss-security/2025/05/16/7","http://www.openwall.com/lists/oss-security/2025/05/17/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00033.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4802","description":"Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo)."}]},{"artifact":{"id":"c4143394e9032e2d","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.31-0ubuntu9.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4802","versionConstraint":"< 2.31-0ubuntu9.18 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-4802","fix":{"state":"fixed","versions":["2.31-0ubuntu9.18"],"available":[{"date":"2025-05-28","kind":"advisory","version":"2.31-0ubuntu9.18"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-4802","cwe":"CWE-426","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-4802","date":"2026-10-28","epss":0.00593,"percentile":0.48216}],"risk":0.29650000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4802"},"relatedVulnerabilities":[{"id":"CVE-2025-4802","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4802","cwe":"CWE-426","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-4802","date":"2026-10-28","epss":0.00593,"percentile":0.48216}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=32976","https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e","http://www.openwall.com/lists/oss-security/2025/05/16/7","http://www.openwall.com/lists/oss-security/2025/05/17/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00033.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4802","description":"Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo)."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-3849","versionConstraint":"<1.23.12||>=1.24.0,<1.24.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-3849","fix":{"state":"fixed","versions":["1.23.12","1.24.6"],"available":[{"date":"2025-08-06","kind":"release","version":"1.23.12"},{"date":"2025-08-06","kind":"release","version":"1.24.6"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47907","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-47907","date":"2026-10-28","epss":0.00406,"percentile":0.34786}],"risk":0.29435,"urls":["https://go.dev/issue/74831","https://groups.google.com/g/golang-announce/c/x5MKroML2yM"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/693735","description":"Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error."},"relatedVulnerabilities":[{"id":"CVE-2025-47907","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47907","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-47907","date":"2026-10-28","epss":0.00406,"percentile":0.34786}],"urls":["https://go.dev/cl/693735","https://go.dev/issue/74831","https://groups.google.com/g/golang-announce/c/x5MKroML2yM","https://pkg.go.dev/vuln/GO-2025-3849","http://www.openwall.com/lists/oss-security/2025/08/06/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47907","description":"Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error."}]},{"artifact":{"id":"34f967921c09dcd9","cpes":["cpe:2.3:a:curl:curl:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-28","epss":0.00584,"percentile":0.4779}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18924"},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-28","epss":0.00584,"percentile":0.4779}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"bf88a5f755934444","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-28","epss":0.00584,"percentile":0.4779}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18924"},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-28","epss":0.00584,"percentile":0.4779}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"25fcf12ace6abd0f","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-28","epss":0.00584,"percentile":0.4779}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18924"},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-28","epss":0.00584,"percentile":0.4779}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4012","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4012","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58186","date":"2026-10-28","epss":0.00565,"percentile":0.46783}],"risk":0.290975,"urls":["https://go.dev/cl/709855","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75672","description":"Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-58186","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58186","date":"2026-10-28","epss":0.00565,"percentile":0.46783}],"urls":["https://go.dev/cl/709855","https://go.dev/issue/75672","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4012","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58186","description":"Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-2522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-2522","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-2522","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2022-2522","date":"2026-10-28","epss":0.00581,"percentile":0.47608}],"risk":0.2905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-2522"},"relatedVulnerabilities":[{"id":"CVE-2022-2522","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2522","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2022-2522","date":"2026-10-28","epss":0.00581,"percentile":0.47608}],"urls":["https://github.com/vim/vim/commit/5fa9f23a63651a8abdb074b4fc2ec9b1adc6b089","https://github.com/vim/vim/commit/b9e717367c395490149495cf375911b5d9de889e","https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22","https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22/","https://security.gentoo.org/glsa/202305-16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2522","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-2522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-2522","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-2522","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2022-2522","date":"2026-10-28","epss":0.00581,"percentile":0.47608}],"risk":0.2905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-2522"},"relatedVulnerabilities":[{"id":"CVE-2022-2522","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2522","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2022-2522","date":"2026-10-28","epss":0.00581,"percentile":0.47608}],"urls":["https://github.com/vim/vim/commit/5fa9f23a63651a8abdb074b4fc2ec9b1adc6b089","https://github.com/vim/vim/commit/b9e717367c395490149495cf375911b5d9de889e","https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22","https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22/","https://security.gentoo.org/glsa/202305-16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2522","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-2522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-2522","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-2522","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2022-2522","date":"2026-10-28","epss":0.00581,"percentile":0.47608}],"risk":0.2905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-2522"},"relatedVulnerabilities":[{"id":"CVE-2022-2522","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2522","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2022-2522","date":"2026-10-28","epss":0.00581,"percentile":0.47608}],"urls":["https://github.com/vim/vim/commit/5fa9f23a63651a8abdb074b4fc2ec9b1adc6b089","https://github.com/vim/vim/commit/b9e717367c395490149495cf375911b5d9de889e","https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22","https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22/","https://security.gentoo.org/glsa/202305-16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2522","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061."}]},{"artifact":{"id":"9ad028a9a47a9fb7","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-28","epss":0.05804,"percentile":0.93101}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20796"},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-28","epss":0.05804,"percentile":0.93101}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"c4143394e9032e2d","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-28","epss":0.05804,"percentile":0.93101}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20796"},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-28","epss":0.05804,"percentile":0.93101}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"8cb74e3775c9e438","cpes":["cpe:2.3:a:locales:locales:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.31-0ubuntu9.18?arch=all&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-28","epss":0.05804,"percentile":0.93101}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20796"},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-28","epss":0.05804,"percentile":0.93101}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6100","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-6100","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6100","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-787","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6100","date":"2026-10-28","epss":0.00579,"percentile":0.47519}],"risk":0.2895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6100"},"relatedVulnerabilities":[{"id":"CVE-2026-6100","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6100","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-787","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6100","date":"2026-10-28","epss":0.00579,"percentile":0.47519}],"urls":["https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e","https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d","https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2","https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20","https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b","https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3","https://github.com/python/cpython/issues/148395","https://github.com/python/cpython/pull/148396","https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/","http://www.openwall.com/lists/oss-security/2026/04/13/10","https://access.redhat.com/errata/RHSA-2026:10117","https://access.redhat.com/errata/RHSA-2026:10140","https://access.redhat.com/errata/RHSA-2026:10141","https://access.redhat.com/errata/RHSA-2026:10711","https://access.redhat.com/errata/RHSA-2026:10745","https://access.redhat.com/errata/RHSA-2026:10774","https://access.redhat.com/errata/RHSA-2026:10949","https://access.redhat.com/errata/RHSA-2026:10950","https://access.redhat.com/errata/RHSA-2026:11062","https://access.redhat.com/errata/RHSA-2026:11077","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:13692","https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:14652","https://access.redhat.com/errata/RHSA-2026:14653","https://access.redhat.com/errata/RHSA-2026:14656","https://access.redhat.com/errata/RHSA-2026:16699","https://access.redhat.com/errata/RHSA-2026:17525","https://access.redhat.com/errata/RHSA-2026:17619","https://access.redhat.com/errata/RHSA-2026:19019","https://access.redhat.com/errata/RHSA-2026:19064","https://access.redhat.com/errata/RHSA-2026:19175","https://access.redhat.com/errata/RHSA-2026:19176","https://access.redhat.com/errata/RHSA-2026:19177","https://access.redhat.com/errata/RHSA-2026:19216","https://access.redhat.com/errata/RHSA-2026:19549","https://access.redhat.com/errata/RHSA-2026:19570","https://access.redhat.com/errata/RHSA-2026:19571","https://access.redhat.com/errata/RHSA-2026:19576","https://access.redhat.com/errata/RHSA-2026:19590","https://access.redhat.com/errata/RHSA-2026:21275","https://access.redhat.com/errata/RHSA-2026:21682","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:26187","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:52400","https://access.redhat.com/errata/RHSA-2026:8822","https://access.redhat.com/errata/RHSA-2026:8824","https://access.redhat.com/errata/RHSA-2026:9228","https://access.redhat.com/security/cve/CVE-2026-6100","https://bugzilla.redhat.com/show_bug.cgi?id=2457932","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6100","description":"Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.\n\nThe vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6100","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-6100","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6100","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-787","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6100","date":"2026-10-28","epss":0.00579,"percentile":0.47519}],"risk":0.2895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6100"},"relatedVulnerabilities":[{"id":"CVE-2026-6100","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6100","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-787","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6100","date":"2026-10-28","epss":0.00579,"percentile":0.47519}],"urls":["https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e","https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d","https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2","https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20","https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b","https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3","https://github.com/python/cpython/issues/148395","https://github.com/python/cpython/pull/148396","https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/","http://www.openwall.com/lists/oss-security/2026/04/13/10","https://access.redhat.com/errata/RHSA-2026:10117","https://access.redhat.com/errata/RHSA-2026:10140","https://access.redhat.com/errata/RHSA-2026:10141","https://access.redhat.com/errata/RHSA-2026:10711","https://access.redhat.com/errata/RHSA-2026:10745","https://access.redhat.com/errata/RHSA-2026:10774","https://access.redhat.com/errata/RHSA-2026:10949","https://access.redhat.com/errata/RHSA-2026:10950","https://access.redhat.com/errata/RHSA-2026:11062","https://access.redhat.com/errata/RHSA-2026:11077","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:13692","https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:14652","https://access.redhat.com/errata/RHSA-2026:14653","https://access.redhat.com/errata/RHSA-2026:14656","https://access.redhat.com/errata/RHSA-2026:16699","https://access.redhat.com/errata/RHSA-2026:17525","https://access.redhat.com/errata/RHSA-2026:17619","https://access.redhat.com/errata/RHSA-2026:19019","https://access.redhat.com/errata/RHSA-2026:19064","https://access.redhat.com/errata/RHSA-2026:19175","https://access.redhat.com/errata/RHSA-2026:19176","https://access.redhat.com/errata/RHSA-2026:19177","https://access.redhat.com/errata/RHSA-2026:19216","https://access.redhat.com/errata/RHSA-2026:19549","https://access.redhat.com/errata/RHSA-2026:19570","https://access.redhat.com/errata/RHSA-2026:19571","https://access.redhat.com/errata/RHSA-2026:19576","https://access.redhat.com/errata/RHSA-2026:19590","https://access.redhat.com/errata/RHSA-2026:21275","https://access.redhat.com/errata/RHSA-2026:21682","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:26187","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:52400","https://access.redhat.com/errata/RHSA-2026:8822","https://access.redhat.com/errata/RHSA-2026:8824","https://access.redhat.com/errata/RHSA-2026:9228","https://access.redhat.com/security/cve/CVE-2026-6100","https://bugzilla.redhat.com/show_bug.cgi?id=2457932","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6100","description":"Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.\n\nThe vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6100","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-6100","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6100","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-787","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6100","date":"2026-10-28","epss":0.00579,"percentile":0.47519}],"risk":0.2895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6100"},"relatedVulnerabilities":[{"id":"CVE-2026-6100","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6100","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-787","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6100","date":"2026-10-28","epss":0.00579,"percentile":0.47519}],"urls":["https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e","https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d","https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2","https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20","https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b","https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3","https://github.com/python/cpython/issues/148395","https://github.com/python/cpython/pull/148396","https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/","http://www.openwall.com/lists/oss-security/2026/04/13/10","https://access.redhat.com/errata/RHSA-2026:10117","https://access.redhat.com/errata/RHSA-2026:10140","https://access.redhat.com/errata/RHSA-2026:10141","https://access.redhat.com/errata/RHSA-2026:10711","https://access.redhat.com/errata/RHSA-2026:10745","https://access.redhat.com/errata/RHSA-2026:10774","https://access.redhat.com/errata/RHSA-2026:10949","https://access.redhat.com/errata/RHSA-2026:10950","https://access.redhat.com/errata/RHSA-2026:11062","https://access.redhat.com/errata/RHSA-2026:11077","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:13692","https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:14652","https://access.redhat.com/errata/RHSA-2026:14653","https://access.redhat.com/errata/RHSA-2026:14656","https://access.redhat.com/errata/RHSA-2026:16699","https://access.redhat.com/errata/RHSA-2026:17525","https://access.redhat.com/errata/RHSA-2026:17619","https://access.redhat.com/errata/RHSA-2026:19019","https://access.redhat.com/errata/RHSA-2026:19064","https://access.redhat.com/errata/RHSA-2026:19175","https://access.redhat.com/errata/RHSA-2026:19176","https://access.redhat.com/errata/RHSA-2026:19177","https://access.redhat.com/errata/RHSA-2026:19216","https://access.redhat.com/errata/RHSA-2026:19549","https://access.redhat.com/errata/RHSA-2026:19570","https://access.redhat.com/errata/RHSA-2026:19571","https://access.redhat.com/errata/RHSA-2026:19576","https://access.redhat.com/errata/RHSA-2026:19590","https://access.redhat.com/errata/RHSA-2026:21275","https://access.redhat.com/errata/RHSA-2026:21682","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:26187","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:52400","https://access.redhat.com/errata/RHSA-2026:8822","https://access.redhat.com/errata/RHSA-2026:8824","https://access.redhat.com/errata/RHSA-2026:9228","https://access.redhat.com/security/cve/CVE-2026-6100","https://bugzilla.redhat.com/show_bug.cgi?id=2457932","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6100","description":"Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.\n\nThe vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6100","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-6100","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6100","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-787","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6100","date":"2026-10-28","epss":0.00579,"percentile":0.47519}],"risk":0.2895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6100"},"relatedVulnerabilities":[{"id":"CVE-2026-6100","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6100","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-787","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6100","date":"2026-10-28","epss":0.00579,"percentile":0.47519}],"urls":["https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e","https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d","https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2","https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20","https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b","https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3","https://github.com/python/cpython/issues/148395","https://github.com/python/cpython/pull/148396","https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/","http://www.openwall.com/lists/oss-security/2026/04/13/10","https://access.redhat.com/errata/RHSA-2026:10117","https://access.redhat.com/errata/RHSA-2026:10140","https://access.redhat.com/errata/RHSA-2026:10141","https://access.redhat.com/errata/RHSA-2026:10711","https://access.redhat.com/errata/RHSA-2026:10745","https://access.redhat.com/errata/RHSA-2026:10774","https://access.redhat.com/errata/RHSA-2026:10949","https://access.redhat.com/errata/RHSA-2026:10950","https://access.redhat.com/errata/RHSA-2026:11062","https://access.redhat.com/errata/RHSA-2026:11077","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:13692","https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:14652","https://access.redhat.com/errata/RHSA-2026:14653","https://access.redhat.com/errata/RHSA-2026:14656","https://access.redhat.com/errata/RHSA-2026:16699","https://access.redhat.com/errata/RHSA-2026:17525","https://access.redhat.com/errata/RHSA-2026:17619","https://access.redhat.com/errata/RHSA-2026:19019","https://access.redhat.com/errata/RHSA-2026:19064","https://access.redhat.com/errata/RHSA-2026:19175","https://access.redhat.com/errata/RHSA-2026:19176","https://access.redhat.com/errata/RHSA-2026:19177","https://access.redhat.com/errata/RHSA-2026:19216","https://access.redhat.com/errata/RHSA-2026:19549","https://access.redhat.com/errata/RHSA-2026:19570","https://access.redhat.com/errata/RHSA-2026:19571","https://access.redhat.com/errata/RHSA-2026:19576","https://access.redhat.com/errata/RHSA-2026:19590","https://access.redhat.com/errata/RHSA-2026:21275","https://access.redhat.com/errata/RHSA-2026:21682","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:26187","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:52400","https://access.redhat.com/errata/RHSA-2026:8822","https://access.redhat.com/errata/RHSA-2026:8824","https://access.redhat.com/errata/RHSA-2026:9228","https://access.redhat.com/security/cve/CVE-2026-6100","https://bugzilla.redhat.com/show_bug.cgi?id=2457932","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6100","description":"Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.\n\nThe vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-28","epss":0.00574,"percentile":0.47291}],"risk":0.28700000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12087"},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-28","epss":0.00574,"percentile":0.47291}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-28","epss":0.00574,"percentile":0.47291}],"risk":0.28700000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12087"},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-28","epss":0.00574,"percentile":0.47291}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-28","epss":0.00574,"percentile":0.47291}],"risk":0.28700000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12087"},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-28","epss":0.00574,"percentile":0.47291}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-28","epss":0.00574,"percentile":0.47291}],"risk":0.28700000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12087"},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-28","epss":0.00574,"percentile":0.47291}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1299","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-1299","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-1299","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-1299","date":"2026-10-28","epss":0.00573,"percentile":0.47239}],"risk":0.2865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-1299"},"relatedVulnerabilities":[{"id":"CVE-2026-1299","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1299","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-1299","date":"2026-10-28","epss":0.00573,"percentile":0.47239}],"urls":["https://cve.org/CVERecord?id=CVE-2024-6923","https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413","https://github.com/python/cpython/commit/0a925ab591c45d6638f37b5e57796f36fa0e56d8","https://github.com/python/cpython/commit/7877fe424415bc4a13045e62a90a7277413d8cb9","https://github.com/python/cpython/commit/842ce19a0c0b58d61591e8f6a708c38db1fb94e4","https://github.com/python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36","https://github.com/python/cpython/commit/e417f05ad77a4c30ddc07f99e90fc0cef43e831a","https://github.com/python/cpython/issues/144125","https://github.com/python/cpython/pull/144126","https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1299","description":"The \nemail module, specifically the \"BytesGenerator\" class, didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized. This is only applicable if using \"LiteralHeader\" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in \"BytesGenerator\"."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1299","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-1299","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-1299","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-1299","date":"2026-10-28","epss":0.00573,"percentile":0.47239}],"risk":0.2865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-1299"},"relatedVulnerabilities":[{"id":"CVE-2026-1299","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1299","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-1299","date":"2026-10-28","epss":0.00573,"percentile":0.47239}],"urls":["https://cve.org/CVERecord?id=CVE-2024-6923","https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413","https://github.com/python/cpython/commit/0a925ab591c45d6638f37b5e57796f36fa0e56d8","https://github.com/python/cpython/commit/7877fe424415bc4a13045e62a90a7277413d8cb9","https://github.com/python/cpython/commit/842ce19a0c0b58d61591e8f6a708c38db1fb94e4","https://github.com/python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36","https://github.com/python/cpython/commit/e417f05ad77a4c30ddc07f99e90fc0cef43e831a","https://github.com/python/cpython/issues/144125","https://github.com/python/cpython/pull/144126","https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1299","description":"The \nemail module, specifically the \"BytesGenerator\" class, didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized. This is only applicable if using \"LiteralHeader\" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in \"BytesGenerator\"."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1299","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-1299","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-1299","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-1299","date":"2026-10-28","epss":0.00573,"percentile":0.47239}],"risk":0.2865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-1299"},"relatedVulnerabilities":[{"id":"CVE-2026-1299","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1299","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-1299","date":"2026-10-28","epss":0.00573,"percentile":0.47239}],"urls":["https://cve.org/CVERecord?id=CVE-2024-6923","https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413","https://github.com/python/cpython/commit/0a925ab591c45d6638f37b5e57796f36fa0e56d8","https://github.com/python/cpython/commit/7877fe424415bc4a13045e62a90a7277413d8cb9","https://github.com/python/cpython/commit/842ce19a0c0b58d61591e8f6a708c38db1fb94e4","https://github.com/python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36","https://github.com/python/cpython/commit/e417f05ad77a4c30ddc07f99e90fc0cef43e831a","https://github.com/python/cpython/issues/144125","https://github.com/python/cpython/pull/144126","https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1299","description":"The \nemail module, specifically the \"BytesGenerator\" class, didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized. This is only applicable if using \"LiteralHeader\" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in \"BytesGenerator\"."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1299","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-1299","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-1299","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-1299","date":"2026-10-28","epss":0.00573,"percentile":0.47239}],"risk":0.2865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-1299"},"relatedVulnerabilities":[{"id":"CVE-2026-1299","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1299","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-1299","date":"2026-10-28","epss":0.00573,"percentile":0.47239}],"urls":["https://cve.org/CVERecord?id=CVE-2024-6923","https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413","https://github.com/python/cpython/commit/0a925ab591c45d6638f37b5e57796f36fa0e56d8","https://github.com/python/cpython/commit/7877fe424415bc4a13045e62a90a7277413d8cb9","https://github.com/python/cpython/commit/842ce19a0c0b58d61591e8f6a708c38db1fb94e4","https://github.com/python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36","https://github.com/python/cpython/commit/e417f05ad77a4c30ddc07f99e90fc0cef43e831a","https://github.com/python/cpython/issues/144125","https://github.com/python/cpython/pull/144126","https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1299","description":"The \nemail module, specifically the \"BytesGenerator\" class, didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized. This is only applicable if using \"LiteralHeader\" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in \"BytesGenerator\"."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4011","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4011","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58185","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58185","date":"2026-10-28","epss":0.00556,"percentile":0.46236}],"risk":0.28634,"urls":["https://go.dev/cl/709856","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75671","description":"Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2025-58185","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58185","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58185","date":"2026-10-28","epss":0.00556,"percentile":0.46236}],"urls":["https://go.dev/cl/709856","https://go.dev/issue/75671","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4011","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58185","description":"Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4015","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4015","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61724","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61724","date":"2026-10-28","epss":0.00556,"percentile":0.46236}],"risk":0.28634,"urls":["https://go.dev/issue/75716","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709859","description":"The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61724","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61724","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61724","date":"2026-10-28","epss":0.00556,"percentile":0.46236}],"urls":["https://go.dev/cl/709859","https://go.dev/issue/75716","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4015","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61724","description":"The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4013","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4013","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58188","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58188","date":"2026-10-28","epss":0.00381,"percentile":0.32043}],"risk":0.28575,"urls":["https://go.dev/issue/75675","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709853","description":"Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method.\n\nThis affects programs which validate arbitrary certificate chains."},"relatedVulnerabilities":[{"id":"CVE-2025-58188","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58188","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58188","date":"2026-10-28","epss":0.00381,"percentile":0.32043}],"urls":["https://go.dev/cl/709853","https://go.dev/issue/75675","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4013","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58188","description":"Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains."}]},{"artifact":{"id":"bfe6694a44340acd","cpes":["cpe:2.3:a:libssh-4:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh-4:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*"],"name":"libssh-4","purl":"pkg:deb/ubuntu/libssh-4@0.9.3-2ubuntu2.5?arch=amd64&distro=ubuntu-20.04&upstream=libssh","type":"deb","version":"0.9.3-2ubuntu2.5","language":"","licenses":["BSD-2-clause","BSD-3-clause","LGPL-2.1","LGPL-2.1+~OpenSSL","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh-4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssh-4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-59843","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libssh","version":"0.9.3-2ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-59843","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-59843","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-59843","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-59843","date":"2026-10-28","epss":0.00567,"percentile":0.46891}],"risk":0.2835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-59843"},"relatedVulnerabilities":[{"id":"CVE-2026-59843","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59843","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-59843","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-59843","date":"2026-10-28","epss":0.00567,"percentile":0.46891}],"urls":["https://access.redhat.com/errata/RHSA-2026:42922","https://access.redhat.com/errata/RHSA-2026:55855","https://access.redhat.com/errata/RHSA-2026:62217","https://access.redhat.com/errata/RHSA-2026:62218","https://access.redhat.com/security/cve/CVE-2026-59843","https://bugzilla.redhat.com/show_bug.cgi?id=2498176"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59843","description":"A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-10-28","epss":0.00944,"percentile":0.60942}],"risk":0.2832,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69421"},"relatedVulnerabilities":[{"id":"CVE-2025-69421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-10-28","epss":0.00944,"percentile":0.60942}],"urls":["https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b","https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7","https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd","https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3","https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-69421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-10-28","epss":0.00944,"percentile":0.60942}],"risk":0.2832,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69421"},"relatedVulnerabilities":[{"id":"CVE-2025-69421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-10-28","epss":0.00944,"percentile":0.60942}],"urls":["https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b","https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7","https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd","https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3","https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3833","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3833","date":"2026-10-28","epss":0.00565,"percentile":0.46802}],"risk":0.2825,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3833"},"relatedVulnerabilities":[{"id":"CVE-2026-3833","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3833","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3833","date":"2026-10-28","epss":0.00565,"percentile":0.46802}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:43575","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:62409","https://access.redhat.com/errata/RHSA-2026:62549","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:67857","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-3833","https://bugzilla.redhat.com/show_bug.cgi?id=2445763","https://gitlab.com/gnutls/gnutls/-/issues/1803"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3833","description":"A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure."}]},{"artifact":{"id":"12308dd4ba29a3f4","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A8.2p1-4ubuntu0.13?arch=amd64&distro=ubuntu-20.04&upstream=openssh","type":"deb","version":"1:8.2p1-4ubuntu0.13","language":"","licenses":["BSD-2-clause","BSD-3-clause","Beer-ware","Expat-with-advertising-restriction","Mazieres-BSD-style","OpenSSH","Powell-BSD-style","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.preinst"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssh","version":"1:8.2p1-4ubuntu0.13"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-35385","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35385","cwe":"CWE-281","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-35385","cwe":"CWE-281","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-35385","date":"2026-10-28","epss":0.00563,"percentile":0.46691}],"risk":0.2815,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35385"},"relatedVulnerabilities":[{"id":"CVE-2026-35385","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35385","cwe":"CWE-281","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-35385","cwe":"CWE-281","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-35385","date":"2026-10-28","epss":0.00563,"percentile":0.46691}],"urls":["https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2","https://www.openssh.org/releasenotes.html#10.3p1","https://www.openwall.com/lists/oss-security/2026/04/02/3","https://access.redhat.com/errata/RHSA-2026:12389","https://access.redhat.com/errata/RHSA-2026:13380","https://access.redhat.com/errata/RHSA-2026:13381","https://access.redhat.com/errata/RHSA-2026:13383","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:16059","https://access.redhat.com/errata/RHSA-2026:19069","https://access.redhat.com/errata/RHSA-2026:19219","https://access.redhat.com/errata/RHSA-2026:20040","https://access.redhat.com/errata/RHSA-2026:21275","https://access.redhat.com/errata/RHSA-2026:21298","https://access.redhat.com/errata/RHSA-2026:21398","https://access.redhat.com/errata/RHSA-2026:22329","https://access.redhat.com/errata/RHSA-2026:22468","https://access.redhat.com/errata/RHSA-2026:22564","https://access.redhat.com/errata/RHSA-2026:22648","https://access.redhat.com/errata/RHSA-2026:25044","https://access.redhat.com/errata/RHSA-2026:25063","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:25181","https://access.redhat.com/errata/RHSA-2026:26528","https://access.redhat.com/errata/RHSA-2026:26542","https://access.redhat.com/errata/RHSA-2026:28887","https://access.redhat.com/errata/RHSA-2026:28962","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:34098","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/security/cve/CVE-2026-35385","https://bugzilla.redhat.com/show_bug.cgi?id=2454469","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35385.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35385","description":"In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode)."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-1502","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-1502","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1502","date":"2026-10-28","epss":0.00562,"percentile":0.46653}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-1502"},"relatedVulnerabilities":[{"id":"CVE-2026-1502","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1502","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1502","date":"2026-10-28","epss":0.00562,"percentile":0.46653}],"urls":["https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69","https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53","https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3e","https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8dd","https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2ed","https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ec","https://github.com/python/cpython/issues/146211","https://github.com/python/cpython/pull/146212","https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/","http://www.openwall.com/lists/oss-security/2026/04/11/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1502","description":"CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-1502","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-1502","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1502","date":"2026-10-28","epss":0.00562,"percentile":0.46653}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-1502"},"relatedVulnerabilities":[{"id":"CVE-2026-1502","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1502","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1502","date":"2026-10-28","epss":0.00562,"percentile":0.46653}],"urls":["https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69","https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53","https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3e","https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8dd","https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2ed","https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ec","https://github.com/python/cpython/issues/146211","https://github.com/python/cpython/pull/146212","https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/","http://www.openwall.com/lists/oss-security/2026/04/11/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1502","description":"CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-1502","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-1502","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1502","date":"2026-10-28","epss":0.00562,"percentile":0.46653}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-1502"},"relatedVulnerabilities":[{"id":"CVE-2026-1502","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1502","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1502","date":"2026-10-28","epss":0.00562,"percentile":0.46653}],"urls":["https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69","https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53","https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3e","https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8dd","https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2ed","https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ec","https://github.com/python/cpython/issues/146211","https://github.com/python/cpython/pull/146212","https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/","http://www.openwall.com/lists/oss-security/2026/04/11/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1502","description":"CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-1502","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-1502","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1502","date":"2026-10-28","epss":0.00562,"percentile":0.46653}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-1502"},"relatedVulnerabilities":[{"id":"CVE-2026-1502","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1502","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1502","date":"2026-10-28","epss":0.00562,"percentile":0.46653}],"urls":["https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69","https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53","https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3e","https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8dd","https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2ed","https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ec","https://github.com/python/cpython/issues/146211","https://github.com/python/cpython/pull/146212","https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/","http://www.openwall.com/lists/oss-security/2026/04/11/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1502","description":"CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3134","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-3134","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3134","cwe":"CWE-416","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-3134","cwe":"CWE-416","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-3134","date":"2026-10-28","epss":0.00561,"percentile":0.46532}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3134"},"relatedVulnerabilities":[{"id":"CVE-2022-3134","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3134","cwe":"CWE-416","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-3134","cwe":"CWE-416","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-3134","date":"2026-10-28","epss":0.00561,"percentile":0.46532}],"urls":["https://github.com/vim/vim/commit/ccfde4d028e891a41e3548323c3d47b06fb0b83e","https://huntr.dev/bounties/6ec79e49-c7ab-4cd6-a517-e7934c2eb9dc","https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html","https://security.gentoo.org/glsa/202305-16","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3134","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0389."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3134","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-3134","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3134","cwe":"CWE-416","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-3134","cwe":"CWE-416","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-3134","date":"2026-10-28","epss":0.00561,"percentile":0.46532}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3134"},"relatedVulnerabilities":[{"id":"CVE-2022-3134","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3134","cwe":"CWE-416","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-3134","cwe":"CWE-416","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-3134","date":"2026-10-28","epss":0.00561,"percentile":0.46532}],"urls":["https://github.com/vim/vim/commit/ccfde4d028e891a41e3548323c3d47b06fb0b83e","https://huntr.dev/bounties/6ec79e49-c7ab-4cd6-a517-e7934c2eb9dc","https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html","https://security.gentoo.org/glsa/202305-16","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3134","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0389."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3134","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-3134","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3134","cwe":"CWE-416","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-3134","cwe":"CWE-416","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-3134","date":"2026-10-28","epss":0.00561,"percentile":0.46532}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3134"},"relatedVulnerabilities":[{"id":"CVE-2022-3134","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3134","cwe":"CWE-416","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-3134","cwe":"CWE-416","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-3134","date":"2026-10-28","epss":0.00561,"percentile":0.46532}],"urls":["https://github.com/vim/vim/commit/ccfde4d028e891a41e3548323c3d47b06fb0b83e","https://huntr.dev/bounties/6ec79e49-c7ab-4cd6-a517-e7934c2eb9dc","https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html","https://security.gentoo.org/glsa/202305-16","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3134","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0389."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0865","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0865","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0865","cwe":"CWE-74","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0865","date":"2026-10-28","epss":0.00554,"percentile":0.46154}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0865"},"relatedVulnerabilities":[{"id":"CVE-2026-0865","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0865","cwe":"CWE-74","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0865","date":"2026-10-28","epss":0.00554,"percentile":0.46154}],"urls":["https://github.com/python/cpython/commit/22e4d55285cee52bc4dbe061324e5f30bd4dee58","https://github.com/python/cpython/commit/23e3c0ae867cca0130e441e776c9955b9027c510","https://github.com/python/cpython/commit/286e3ac39984fe85a17f4ab39c64d382137aae5f","https://github.com/python/cpython/commit/2f840249550e082dc351743f474ba56da10478d2","https://github.com/python/cpython/commit/4802b96a2cde58570c24c13ef3289490980961c5","https://github.com/python/cpython/commit/66da7bf6fe7b81e3ecc9c0a25bd47d4616c8d1a6","https://github.com/python/cpython/commit/83ecd18779f286d872f68bfce175651e407d9fff","https://github.com/python/cpython/commit/8bb044d29310bb05d15086cdaa8bf64867d61a97","https://github.com/python/cpython/commit/bfba660085767f8c2d582134e9d511a85eda04cf","https://github.com/python/cpython/commit/c592227ffb48679af9845a45dbb0875d975bb219","https://github.com/python/cpython/commit/e4846a93ac07a8ae9aa18203af0dd13d6e7a6995","https://github.com/python/cpython/commit/f7fceed79ca1bceae8dbe5ba5bc8928564da7211","https://github.com/python/cpython/issues/143916","https://github.com/python/cpython/pull/143917","https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0865","description":"User-controlled header names and values containing newlines can allow injecting HTTP headers."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0865","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0865","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0865","cwe":"CWE-74","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0865","date":"2026-10-28","epss":0.00554,"percentile":0.46154}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0865"},"relatedVulnerabilities":[{"id":"CVE-2026-0865","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0865","cwe":"CWE-74","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0865","date":"2026-10-28","epss":0.00554,"percentile":0.46154}],"urls":["https://github.com/python/cpython/commit/22e4d55285cee52bc4dbe061324e5f30bd4dee58","https://github.com/python/cpython/commit/23e3c0ae867cca0130e441e776c9955b9027c510","https://github.com/python/cpython/commit/286e3ac39984fe85a17f4ab39c64d382137aae5f","https://github.com/python/cpython/commit/2f840249550e082dc351743f474ba56da10478d2","https://github.com/python/cpython/commit/4802b96a2cde58570c24c13ef3289490980961c5","https://github.com/python/cpython/commit/66da7bf6fe7b81e3ecc9c0a25bd47d4616c8d1a6","https://github.com/python/cpython/commit/83ecd18779f286d872f68bfce175651e407d9fff","https://github.com/python/cpython/commit/8bb044d29310bb05d15086cdaa8bf64867d61a97","https://github.com/python/cpython/commit/bfba660085767f8c2d582134e9d511a85eda04cf","https://github.com/python/cpython/commit/c592227ffb48679af9845a45dbb0875d975bb219","https://github.com/python/cpython/commit/e4846a93ac07a8ae9aa18203af0dd13d6e7a6995","https://github.com/python/cpython/commit/f7fceed79ca1bceae8dbe5ba5bc8928564da7211","https://github.com/python/cpython/issues/143916","https://github.com/python/cpython/pull/143917","https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0865","description":"User-controlled header names and values containing newlines can allow injecting HTTP headers."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0865","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0865","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0865","cwe":"CWE-74","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0865","date":"2026-10-28","epss":0.00554,"percentile":0.46154}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0865"},"relatedVulnerabilities":[{"id":"CVE-2026-0865","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0865","cwe":"CWE-74","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0865","date":"2026-10-28","epss":0.00554,"percentile":0.46154}],"urls":["https://github.com/python/cpython/commit/22e4d55285cee52bc4dbe061324e5f30bd4dee58","https://github.com/python/cpython/commit/23e3c0ae867cca0130e441e776c9955b9027c510","https://github.com/python/cpython/commit/286e3ac39984fe85a17f4ab39c64d382137aae5f","https://github.com/python/cpython/commit/2f840249550e082dc351743f474ba56da10478d2","https://github.com/python/cpython/commit/4802b96a2cde58570c24c13ef3289490980961c5","https://github.com/python/cpython/commit/66da7bf6fe7b81e3ecc9c0a25bd47d4616c8d1a6","https://github.com/python/cpython/commit/83ecd18779f286d872f68bfce175651e407d9fff","https://github.com/python/cpython/commit/8bb044d29310bb05d15086cdaa8bf64867d61a97","https://github.com/python/cpython/commit/bfba660085767f8c2d582134e9d511a85eda04cf","https://github.com/python/cpython/commit/c592227ffb48679af9845a45dbb0875d975bb219","https://github.com/python/cpython/commit/e4846a93ac07a8ae9aa18203af0dd13d6e7a6995","https://github.com/python/cpython/commit/f7fceed79ca1bceae8dbe5ba5bc8928564da7211","https://github.com/python/cpython/issues/143916","https://github.com/python/cpython/pull/143917","https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0865","description":"User-controlled header names and values containing newlines can allow injecting HTTP headers."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0865","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0865","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0865","cwe":"CWE-74","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0865","date":"2026-10-28","epss":0.00554,"percentile":0.46154}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0865"},"relatedVulnerabilities":[{"id":"CVE-2026-0865","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0865","cwe":"CWE-74","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0865","date":"2026-10-28","epss":0.00554,"percentile":0.46154}],"urls":["https://github.com/python/cpython/commit/22e4d55285cee52bc4dbe061324e5f30bd4dee58","https://github.com/python/cpython/commit/23e3c0ae867cca0130e441e776c9955b9027c510","https://github.com/python/cpython/commit/286e3ac39984fe85a17f4ab39c64d382137aae5f","https://github.com/python/cpython/commit/2f840249550e082dc351743f474ba56da10478d2","https://github.com/python/cpython/commit/4802b96a2cde58570c24c13ef3289490980961c5","https://github.com/python/cpython/commit/66da7bf6fe7b81e3ecc9c0a25bd47d4616c8d1a6","https://github.com/python/cpython/commit/83ecd18779f286d872f68bfce175651e407d9fff","https://github.com/python/cpython/commit/8bb044d29310bb05d15086cdaa8bf64867d61a97","https://github.com/python/cpython/commit/bfba660085767f8c2d582134e9d511a85eda04cf","https://github.com/python/cpython/commit/c592227ffb48679af9845a45dbb0875d975bb219","https://github.com/python/cpython/commit/e4846a93ac07a8ae9aa18203af0dd13d6e7a6995","https://github.com/python/cpython/commit/f7fceed79ca1bceae8dbe5ba5bc8928564da7211","https://github.com/python/cpython/issues/143916","https://github.com/python/cpython/pull/143917","https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0865","description":"User-controlled header names and values containing newlines can allow injecting HTTP headers."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-28","epss":0.00553,"percentile":0.46091}],"risk":0.2765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-28","epss":0.00553,"percentile":0.46091}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-28","epss":0.00553,"percentile":0.46091}],"risk":0.2765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-28","epss":0.00553,"percentile":0.46091}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-28","epss":0.00553,"percentile":0.46091}],"risk":0.2765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-28","epss":0.00553,"percentile":0.46091}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-28","epss":0.00553,"percentile":0.46091}],"risk":0.2765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-28","epss":0.00553,"percentile":0.46091}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46483","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-46483","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46483","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46483","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-46483","date":"2026-10-28","epss":0.00552,"percentile":0.46021}],"risk":0.27599999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46483"},"relatedVulnerabilities":[{"id":"CVE-2026-46483","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46483","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46483","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-46483","date":"2026-10-28","epss":0.00552,"percentile":0.46021}],"urls":["https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1","https://github.com/vim/vim/releases/tag/v9.2.0479","https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46483","description":"Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in\nruntime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46483","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-46483","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46483","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46483","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-46483","date":"2026-10-28","epss":0.00552,"percentile":0.46021}],"risk":0.27599999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46483"},"relatedVulnerabilities":[{"id":"CVE-2026-46483","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46483","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46483","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-46483","date":"2026-10-28","epss":0.00552,"percentile":0.46021}],"urls":["https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1","https://github.com/vim/vim/releases/tag/v9.2.0479","https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46483","description":"Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in\nruntime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46483","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-46483","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46483","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46483","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-46483","date":"2026-10-28","epss":0.00552,"percentile":0.46021}],"risk":0.27599999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46483"},"relatedVulnerabilities":[{"id":"CVE-2026-46483","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46483","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46483","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-46483","date":"2026-10-28","epss":0.00552,"percentile":0.46021}],"urls":["https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1","https://github.com/vim/vim/releases/tag/v9.2.0479","https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46483","description":"Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in\nruntime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69420","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69420","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-10-28","epss":0.0092,"percentile":0.60159}],"risk":0.27599999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69420"},"relatedVulnerabilities":[{"id":"CVE-2025-69420","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-10-28","epss":0.0092,"percentile":0.60159}],"urls":["https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9","https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a","https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e","https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b","https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-69420","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69420","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-10-28","epss":0.0092,"percentile":0.60159}],"risk":0.27599999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69420"},"relatedVulnerabilities":[{"id":"CVE-2025-69420","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-10-28","epss":0.0092,"percentile":0.60159}],"urls":["https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9","https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a","https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e","https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b","https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-28","epss":0.00547,"percentile":0.45689}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-28","epss":0.00547,"percentile":0.45689}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-28","epss":0.00547,"percentile":0.45689}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-28","epss":0.00547,"percentile":0.45689}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-28","epss":0.00547,"percentile":0.45689}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-28","epss":0.00547,"percentile":0.45689}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-28","epss":0.00547,"percentile":0.45689}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-10-28","epss":0.00547,"percentile":0.45689}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15282","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15282","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15282","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15282","date":"2026-10-28","epss":0.00537,"percentile":0.45145}],"risk":0.26849999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15282"},"relatedVulnerabilities":[{"id":"CVE-2025-15282","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15282","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15282","date":"2026-10-28","epss":0.00537,"percentile":0.45145}],"urls":["https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0","https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38","https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80","https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47","https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a","https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f","https://github.com/python/cpython/issues/143925","https://github.com/python/cpython/pull/143926","https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15282","description":"User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15282","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15282","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15282","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15282","date":"2026-10-28","epss":0.00537,"percentile":0.45145}],"risk":0.26849999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15282"},"relatedVulnerabilities":[{"id":"CVE-2025-15282","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15282","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15282","date":"2026-10-28","epss":0.00537,"percentile":0.45145}],"urls":["https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0","https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38","https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80","https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47","https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a","https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f","https://github.com/python/cpython/issues/143925","https://github.com/python/cpython/pull/143926","https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15282","description":"User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15282","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15282","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15282","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15282","date":"2026-10-28","epss":0.00537,"percentile":0.45145}],"risk":0.26849999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15282"},"relatedVulnerabilities":[{"id":"CVE-2025-15282","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15282","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15282","date":"2026-10-28","epss":0.00537,"percentile":0.45145}],"urls":["https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0","https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38","https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80","https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47","https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a","https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f","https://github.com/python/cpython/issues/143925","https://github.com/python/cpython/pull/143926","https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15282","description":"User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15282","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15282","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15282","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15282","date":"2026-10-28","epss":0.00537,"percentile":0.45145}],"risk":0.26849999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15282"},"relatedVulnerabilities":[{"id":"CVE-2025-15282","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15282","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15282","date":"2026-10-28","epss":0.00537,"percentile":0.45145}],"urls":["https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0","https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38","https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80","https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47","https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a","https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f","https://github.com/python/cpython/issues/143925","https://github.com/python/cpython/pull/143926","https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15282","description":"User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-10-28","epss":0.00534,"percentile":0.44973}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-10-28","epss":0.00534,"percentile":0.44973}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-10-28","epss":0.00534,"percentile":0.44973}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-10-28","epss":0.00534,"percentile":0.44973}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-10-28","epss":0.00534,"percentile":0.44973}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-10-28","epss":0.00534,"percentile":0.44973}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-10-28","epss":0.00534,"percentile":0.44973}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-10-28","epss":0.00534,"percentile":0.44973}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"12308dd4ba29a3f4","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A8.2p1-4ubuntu0.13?arch=amd64&distro=ubuntu-20.04&upstream=openssh","type":"deb","version":"1:8.2p1-4ubuntu0.13","language":"","licenses":["BSD-2-clause","BSD-3-clause","Beer-ware","Expat-with-advertising-restriction","Mazieres-BSD-style","OpenSSH","Powell-BSD-style","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.preinst"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-20012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssh","version":"1:8.2p1-4ubuntu0.13"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2016-20012","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-20012","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-20012","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-20012","date":"2026-10-28","epss":0.05326,"percentile":0.92586}],"risk":0.26630000000000004,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-20012"},"relatedVulnerabilities":[{"id":"CVE-2016-20012","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-20012","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-20012","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-20012","date":"2026-10-28","epss":0.05326,"percentile":0.92586}],"urls":["https://github.com/openssh/openssh-portable/blob/d0fffc88c8fe90c1815c6f4097bc8cbcabc0f3dd/auth2-pubkey.c#L261-L265","https://github.com/openssh/openssh-portable/pull/270","https://github.com/openssh/openssh-portable/pull/270#issuecomment-920577097","https://github.com/openssh/openssh-portable/pull/270#issuecomment-943909185","https://rushter.com/blog/public-ssh-keys/","https://security.netapp.com/advisory/ntap-20211014-0005/","https://utcc.utoronto.ca/~cks/space/blog/tech/SSHKeysAreInfoLeak","https://www.openwall.com/lists/oss-security/2018/08/24/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-20012","description":"OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product"}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4946","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4946","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32281","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32281","date":"2026-10-28","epss":0.00355,"percentile":0.29119}],"risk":0.26625,"urls":["https://go.dev/issue/78281","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/758061","description":"Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.\n\nThis only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool."},"relatedVulnerabilities":[{"id":"CVE-2026-32281","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32281","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32281","date":"2026-10-28","epss":0.00355,"percentile":0.29119}],"urls":["https://go.dev/cl/758061","https://go.dev/issue/78281","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4946"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","description":"Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool."}]},{"artifact":{"id":"19f2ad5277a24155","cpes":["cpe:2.3:a:zod:zod:3.25.76:*:*:*:*:*:*:*"],"name":"zod","purl":"pkg:npm/zod@3.25.76","type":"npm","version":"3.25.76","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/code-server/lib/vscode/node_modules/@vscode/sandbox-runtime/node_modules/zod/package.json","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/usr/lib/code-server/lib/vscode/node_modules/@vscode/sandbox-runtime/node_modules/zod/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mrhx-c7xc-m3w5","versionConstraint":"<4.6.6 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"zod","version":"3.25.76"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-mrhx-c7xc-m3w5","fix":{"state":"fixed","versions":["4.6.6"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"4.6.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-54404","date":"2026-10-28","epss":0.00346,"percentile":0.28064}],"risk":0.265555,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-54404","https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","https://github.com/colinhacks/zod/pull/6652","https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","description":"Zod can exhaust memory while validating oversized constrained collections"},"relatedVulnerabilities":[{"id":"CVE-2023-54404","cvss":[],"epss":[{"cve":"CVE-2023-54404","date":"2026-10-28","epss":0.00346,"percentile":0.28064}],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod."}]},{"artifact":{"id":"1220f68465549965","cpes":["cpe:2.3:a:zod:zod:4.3.6:*:*:*:*:*:*:*"],"name":"zod","purl":"pkg:npm/zod@4.3.6","type":"npm","version":"4.3.6","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/code-server/lib/vscode/node_modules/@github/copilot-sdk/node_modules/zod/package.json","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/usr/lib/code-server/lib/vscode/node_modules/@github/copilot-sdk/node_modules/zod/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mrhx-c7xc-m3w5","versionConstraint":"<4.6.6 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"zod","version":"4.3.6"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-mrhx-c7xc-m3w5","fix":{"state":"fixed","versions":["4.6.6"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"4.6.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-54404","date":"2026-10-28","epss":0.00346,"percentile":0.28064}],"risk":0.265555,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-54404","https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","https://github.com/colinhacks/zod/pull/6652","https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","description":"Zod can exhaust memory while validating oversized constrained collections"},"relatedVulnerabilities":[{"id":"CVE-2023-54404","cvss":[],"epss":[{"cve":"CVE-2023-54404","date":"2026-10-28","epss":0.00346,"percentile":0.28064}],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod."}]},{"artifact":{"id":"c21a1693532053be","cpes":["cpe:2.3:a:zod:zod:4.4.3:*:*:*:*:*:*:*"],"name":"zod","purl":"pkg:npm/zod@4.4.3","type":"npm","version":"4.4.3","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/code-server/lib/vscode/node_modules/zod/package.json","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/usr/lib/code-server/lib/vscode/node_modules/zod/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mrhx-c7xc-m3w5","versionConstraint":"<4.6.6 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"zod","version":"4.4.3"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-mrhx-c7xc-m3w5","fix":{"state":"fixed","versions":["4.6.6"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"4.6.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-54404","date":"2026-10-28","epss":0.00346,"percentile":0.28064}],"risk":0.265555,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-54404","https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","https://github.com/colinhacks/zod/pull/6652","https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","description":"Zod can exhaust memory while validating oversized constrained collections"},"relatedVulnerabilities":[{"id":"CVE-2023-54404","cvss":[],"epss":[{"cve":"CVE-2023-54404","date":"2026-10-28","epss":0.00346,"percentile":0.28064}],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28388","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-10-28","epss":0.00885,"percentile":0.59105}],"risk":0.26549999999999996,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28388"},"relatedVulnerabilities":[{"id":"CVE-2026-28388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-10-28","epss":0.00885,"percentile":0.59105}],"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28388","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-10-28","epss":0.00885,"percentile":0.59105}],"risk":0.26549999999999996,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28388"},"relatedVulnerabilities":[{"id":"CVE-2026-28388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-10-28","epss":0.00885,"percentile":0.59105}],"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"12308dd4ba29a3f4","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:8.2p1-4ubuntu0.13:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A8.2p1-4ubuntu0.13?arch=amd64&distro=ubuntu-20.04&upstream=openssh","type":"deb","version":"1:8.2p1-4ubuntu0.13","language":"","licenses":["BSD-2-clause","BSD-3-clause","Beer-ware","Expat-with-advertising-restriction","Mazieres-BSD-style","OpenSSH","Powell-BSD-style","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.preinst"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-55653","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssh","version":"1:8.2p1-4ubuntu0.13"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-55653","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-55653","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-55653","date":"2026-10-28","epss":0.0053,"percentile":0.44662}],"risk":0.265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-55653"},"relatedVulnerabilities":[{"id":"CVE-2026-55653","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55653","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-55653","date":"2026-10-28","epss":0.0053,"percentile":0.44662}],"urls":["https://access.redhat.com/errata/RHSA-2026:36759","https://access.redhat.com/errata/RHSA-2026:47755","https://access.redhat.com/errata/RHSA-2026:47756","https://access.redhat.com/errata/RHSA-2026:47757","https://access.redhat.com/errata/RHSA-2026:54387","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:76748","https://access.redhat.com/errata/RHSA-2026:76993","https://access.redhat.com/errata/RHSA-2026:80513","https://access.redhat.com/errata/RHSA-2026:82749","https://access.redhat.com/errata/RHSA-2026:82750","https://access.redhat.com/errata/RHSA-2026:82751","https://access.redhat.com/errata/RHSA-2026:82752","https://access.redhat.com/errata/RHSA-2026:82753","https://access.redhat.com/errata/RHSA-2026:82754","https://access.redhat.com/errata/RHSA-2026:82755","https://access.redhat.com/errata/RHSA-2026:82756","https://access.redhat.com/errata/RHSA-2026:82757","https://access.redhat.com/errata/RHSA-2026:82758","https://access.redhat.com/errata/RHSA-2026:82759","https://access.redhat.com/errata/RHSA-2026:82761","https://access.redhat.com/errata/RHSA-2026:82762","https://access.redhat.com/errata/RHSA-2026:82763","https://access.redhat.com/errata/RHSA-2026:82897","https://access.redhat.com/errata/RHSA-2026:82898","https://access.redhat.com/errata/RHSA-2026:82899","https://access.redhat.com/errata/RHSA-2026:82900","https://access.redhat.com/errata/RHSA-2026:82901","https://access.redhat.com/errata/RHSA-2026:82902","https://access.redhat.com/errata/RHSA-2026:82903","https://access.redhat.com/errata/RHSA-2026:82904","https://access.redhat.com/errata/RHSA-2026:82907","https://access.redhat.com/errata/RHSA-2026:82908","https://access.redhat.com/errata/RHSA-2026:82909","https://access.redhat.com/errata/RHSA-2026:82910","https://access.redhat.com/errata/RHSA-2026:82912","https://access.redhat.com/errata/RHSA-2026:82913","https://access.redhat.com/errata/RHSA-2026:82914","https://access.redhat.com/errata/RHSA-2026:82915","https://access.redhat.com/errata/RHSA-2026:82916","https://access.redhat.com/errata/RHSA-2026:82917","https://access.redhat.com/errata/RHSA-2026:82918","https://access.redhat.com/errata/RHSA-2026:82920","https://access.redhat.com/errata/RHSA-2026:82921","https://access.redhat.com/errata/RHSA-2026:82922","https://access.redhat.com/errata/RHSA-2026:82923","https://access.redhat.com/errata/RHSA-2026:89739","https://access.redhat.com/security/cve/CVE-2026-55653","https://bugzilla.redhat.com/show_bug.cgi?id=2462351"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55653","description":"A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS)."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-28","epss":0.00528,"percentile":0.44596}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-28","epss":0.00528,"percentile":0.44596}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-28","epss":0.00528,"percentile":0.44596}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-28","epss":0.00528,"percentile":0.44596}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-28","epss":0.00528,"percentile":0.44596}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-28","epss":0.00528,"percentile":0.44596}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-28","epss":0.00528,"percentile":0.44596}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-10-28","epss":0.00528,"percentile":0.44596}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-10-28","epss":0.00526,"percentile":0.44431}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-10-28","epss":0.00526,"percentile":0.44431}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-10-28","epss":0.00526,"percentile":0.44431}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-10-28","epss":0.00526,"percentile":0.44431}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-10-28","epss":0.00526,"percentile":0.44431}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-10-28","epss":0.00526,"percentile":0.44431}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-10-28","epss":0.00526,"percentile":0.44431}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-10-28","epss":0.00526,"percentile":0.44431}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-28","epss":0.00524,"percentile":0.44357}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-28","epss":0.00524,"percentile":0.44357}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-28","epss":0.00524,"percentile":0.44357}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-28","epss":0.00524,"percentile":0.44357}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-28","epss":0.00524,"percentile":0.44357}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-28","epss":0.00524,"percentile":0.44357}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-28","epss":0.00524,"percentile":0.44357}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-10-28","epss":0.00524,"percentile":0.44357}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"1ec2a53545b654f8","cpes":["cpe:2.3:a:krb5-locales:krb5-locales:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:krb5-locales:krb5_locales:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:krb5_locales:krb5-locales:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:krb5_locales:krb5_locales:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-locales:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_locales:1.17-6ubuntu4.11:*:*:*:*:*:*:*"],"name":"krb5-locales","purl":"pkg:deb/ubuntu/krb5-locales@1.17-6ubuntu4.11?arch=all&distro=ubuntu-20.04&upstream=krb5","type":"deb","version":"1.17-6ubuntu4.11","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/krb5-locales/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/krb5-locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-locales.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/krb5-locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-locales.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/krb5-locales.list"}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"krb5","version":"1.17-6ubuntu4.11"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-28","epss":0.00521,"percentile":0.44098}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-28","epss":0.00521,"percentile":0.44098}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"5f38b4e39807ff82","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.17-6ubuntu4.11:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.17-6ubuntu4.11?arch=amd64&distro=ubuntu-20.04&upstream=krb5","type":"deb","version":"1.17-6ubuntu4.11","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"krb5","version":"1.17-6ubuntu4.11"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-28","epss":0.00521,"percentile":0.44098}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-28","epss":0.00521,"percentile":0.44098}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"00ad3c4c00076eb8","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.17-6ubuntu4.11:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.17-6ubuntu4.11?arch=amd64&distro=ubuntu-20.04&upstream=krb5","type":"deb","version":"1.17-6ubuntu4.11","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"krb5","version":"1.17-6ubuntu4.11"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-28","epss":0.00521,"percentile":0.44098}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-28","epss":0.00521,"percentile":0.44098}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"2bd40669966113dc","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.17-6ubuntu4.11:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.17-6ubuntu4.11?arch=amd64&distro=ubuntu-20.04&upstream=krb5","type":"deb","version":"1.17-6ubuntu4.11","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"krb5","version":"1.17-6ubuntu4.11"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-28","epss":0.00521,"percentile":0.44098}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-28","epss":0.00521,"percentile":0.44098}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"8d245d32416932bf","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.17-6ubuntu4.11:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.17-6ubuntu4.11?arch=amd64&distro=ubuntu-20.04&upstream=krb5","type":"deb","version":"1.17-6ubuntu4.11","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"krb5","version":"1.17-6ubuntu4.11"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-28","epss":0.00521,"percentile":0.44098}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-28","epss":0.00521,"percentile":0.44098}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"34f967921c09dcd9","cpes":["cpe:2.3:a:curl:curl:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6429","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-6429","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-28","epss":0.00519,"percentile":0.43984}],"risk":0.2595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6429"},"relatedVulnerabilities":[{"id":"CVE-2026-6429","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-28","epss":0.00519,"percentile":0.43984}],"urls":["https://curl.se/docs/CVE-2026-6429.html","https://curl.se/docs/CVE-2026-6429.json","https://hackerone.com/reports/3677759"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."}]},{"artifact":{"id":"bf88a5f755934444","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6429","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-6429","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-28","epss":0.00519,"percentile":0.43984}],"risk":0.2595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6429"},"relatedVulnerabilities":[{"id":"CVE-2026-6429","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-28","epss":0.00519,"percentile":0.43984}],"urls":["https://curl.se/docs/CVE-2026-6429.html","https://curl.se/docs/CVE-2026-6429.json","https://hackerone.com/reports/3677759"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."}]},{"artifact":{"id":"25fcf12ace6abd0f","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6429","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-6429","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-28","epss":0.00519,"percentile":0.43984}],"risk":0.2595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6429"},"relatedVulnerabilities":[{"id":"CVE-2026-6429","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-28","epss":0.00519,"percentile":0.43984}],"urls":["https://curl.se/docs/CVE-2026-6429.html","https://curl.se/docs/CVE-2026-6429.json","https://hackerone.com/reports/3677759"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-28","epss":0.00517,"percentile":0.43886}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-28","epss":0.00517,"percentile":0.43886}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-28","epss":0.00517,"percentile":0.43886}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-28","epss":0.00517,"percentile":0.43886}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-28","epss":0.00517,"percentile":0.43886}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-28","epss":0.00517,"percentile":0.43886}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-28","epss":0.00517,"percentile":0.43886}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-28","epss":0.00517,"percentile":0.43886}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"d6d29bd93eea7667","cpes":["cpe:2.3:a:nodejs:undici:7.29.1:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@7.29.1","type":"npm","version":"7.29.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/code-server/lib/vscode/node_modules/undici/package.json","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/usr/lib/code-server/lib/vscode/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.30.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xjj6-f33q-929c","versionConstraint":">=7.18.0,<7.30.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"7.29.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xjj6-f33q-929c","fix":{"state":"fixed","versions":["7.30.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"7.30.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-109869","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109869","date":"2026-10-28","epss":0.00344,"percentile":0.27818}],"risk":0.258,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c","https://nvd.nist.gov/vuln/detail/CVE-2026-109869","https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429","https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436","https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xjj6-f33q-929c","description":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings"},"relatedVulnerabilities":[{"id":"CVE-2026-109869","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-109869","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109869","date":"2026-10-28","epss":0.00344,"percentile":0.27818}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869","description":"undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround."}]},{"artifact":{"id":"5e3f99daab9a1514","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:245.4-4ubuntu3.24:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/ubuntu/libsystemd0@245.4-4ubuntu3.24?arch=amd64&distro=ubuntu-20.04&upstream=systemd","type":"deb","version":"245.4-4ubuntu3.24","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-7008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"systemd","version":"245.4-4ubuntu3.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-7008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-7008","cwe":"CWE-300","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-7008","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-7008","date":"2026-10-28","epss":0.00849,"percentile":0.57995}],"risk":0.2547,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-7008"},"relatedVulnerabilities":[{"id":"CVE-2023-7008","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-7008","cwe":"CWE-300","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-7008","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-7008","date":"2026-10-28","epss":0.00849,"percentile":0.57995}],"urls":["https://access.redhat.com/errata/RHSA-2024:2463","https://access.redhat.com/errata/RHSA-2024:3203","https://access.redhat.com/security/cve/CVE-2023-7008","https://bugzilla.redhat.com/show_bug.cgi?id=2222261","https://bugzilla.redhat.com/show_bug.cgi?id=2222672","https://github.com/systemd/systemd/issues/25676","https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GMDEG5PKONWNHOEYSUDRT6JEOISRMN2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHNBXGKJWISJETTTDTZKTBFIBJUOSLKL/","https://security.netapp.com/advisory/ntap-20241122-0004/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-7008","description":"A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records."}]},{"artifact":{"id":"7fb6e4c8e297c76a","cpes":["cpe:2.3:a:libudev1:libudev1:245.4-4ubuntu3.24:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@245.4-4ubuntu3.24?arch=amd64&distro=ubuntu-20.04&upstream=systemd","type":"deb","version":"245.4-4ubuntu3.24","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-7008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"systemd","version":"245.4-4ubuntu3.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-7008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-7008","cwe":"CWE-300","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-7008","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-7008","date":"2026-10-28","epss":0.00849,"percentile":0.57995}],"risk":0.2547,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-7008"},"relatedVulnerabilities":[{"id":"CVE-2023-7008","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-7008","cwe":"CWE-300","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-7008","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-7008","date":"2026-10-28","epss":0.00849,"percentile":0.57995}],"urls":["https://access.redhat.com/errata/RHSA-2024:2463","https://access.redhat.com/errata/RHSA-2024:3203","https://access.redhat.com/security/cve/CVE-2023-7008","https://bugzilla.redhat.com/show_bug.cgi?id=2222261","https://bugzilla.redhat.com/show_bug.cgi?id=2222672","https://github.com/systemd/systemd/issues/25676","https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GMDEG5PKONWNHOEYSUDRT6JEOISRMN2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHNBXGKJWISJETTTDTZKTBFIBJUOSLKL/","https://security.netapp.com/advisory/ntap-20241122-0004/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-7008","description":"A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records."}]},{"artifact":{"id":"bf291b3ff1f0a486","cpes":["cpe:2.3:a:git:git:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A2.25.1-1ubuntu3.14?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1:2.25.1-1ubuntu3.14","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-52005","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git","version":"1:2.25.1-1ubuntu3.14"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2024-52005","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52005","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-52005","cwe":"CWE-150","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-52005","date":"2026-10-28","epss":0.00509,"percentile":0.43324}],"risk":0.2545,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52005"},"relatedVulnerabilities":[{"id":"CVE-2024-52005","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52005","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-52005","cwe":"CWE-150","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-52005","date":"2026-10-28","epss":0.00509,"percentile":0.43324}],"urls":["https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329","https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52005","description":"Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called \"sideband channel\". These messages will be prefixed with \"remote:\" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources."}]},{"artifact":{"id":"160f2ca74a1211ed","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A2.25.1-1ubuntu3.14?arch=all&distro=ubuntu-20.04&upstream=git","type":"deb","version":"1:2.25.1-1ubuntu3.14","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52005","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git","version":"1:2.25.1-1ubuntu3.14"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2024-52005","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52005","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-52005","cwe":"CWE-150","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-52005","date":"2026-10-28","epss":0.00509,"percentile":0.43324}],"risk":0.2545,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52005"},"relatedVulnerabilities":[{"id":"CVE-2024-52005","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52005","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-52005","cwe":"CWE-150","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-52005","date":"2026-10-28","epss":0.00509,"percentile":0.43324}],"urls":["https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329","https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52005","description":"Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called \"sideband channel\". These messages will be prefixed with \"remote:\" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3235","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-3235","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3235","cwe":"CWE-416","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-3235","cwe":"CWE-416","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-3235","date":"2026-10-28","epss":0.00505,"percentile":0.43021}],"risk":0.2525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3235"},"relatedVulnerabilities":[{"id":"CVE-2022-3235","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3235","cwe":"CWE-416","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-3235","cwe":"CWE-416","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-3235","date":"2026-10-28","epss":0.00505,"percentile":0.43021}],"urls":["https://github.com/vim/vim/commit/1c3dd8ddcba63c1af5112e567215b3cec2de11d0","https://huntr.dev/bounties/96d5f7a0-a834-4571-b73b-0fe523b941af","https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/","https://security.gentoo.org/glsa/202305-16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3235","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0490."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3235","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-3235","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3235","cwe":"CWE-416","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-3235","cwe":"CWE-416","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-3235","date":"2026-10-28","epss":0.00505,"percentile":0.43021}],"risk":0.2525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3235"},"relatedVulnerabilities":[{"id":"CVE-2022-3235","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3235","cwe":"CWE-416","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-3235","cwe":"CWE-416","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-3235","date":"2026-10-28","epss":0.00505,"percentile":0.43021}],"urls":["https://github.com/vim/vim/commit/1c3dd8ddcba63c1af5112e567215b3cec2de11d0","https://huntr.dev/bounties/96d5f7a0-a834-4571-b73b-0fe523b941af","https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/","https://security.gentoo.org/glsa/202305-16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3235","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0490."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3235","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-3235","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3235","cwe":"CWE-416","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-3235","cwe":"CWE-416","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-3235","date":"2026-10-28","epss":0.00505,"percentile":0.43021}],"risk":0.2525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3235"},"relatedVulnerabilities":[{"id":"CVE-2022-3235","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3235","cwe":"CWE-416","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-3235","cwe":"CWE-416","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-3235","date":"2026-10-28","epss":0.00505,"percentile":0.43021}],"urls":["https://github.com/vim/vim/commit/1c3dd8ddcba63c1af5112e567215b3cec2de11d0","https://huntr.dev/bounties/96d5f7a0-a834-4571-b73b-0fe523b941af","https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/","https://security.gentoo.org/glsa/202305-16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3235","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0490."}]},{"artifact":{"id":"9ad028a9a47a9fb7","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5450","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5450","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5450","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-5450","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5450","date":"2026-10-28","epss":0.00502,"percentile":0.42855}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5450"},"relatedVulnerabilities":[{"id":"CVE-2026-5450","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5450","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-5450","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5450","date":"2026-10-28","epss":0.00502,"percentile":0.42855}],"urls":["https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5450","description":"Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow."}]},{"artifact":{"id":"c4143394e9032e2d","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5450","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5450","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5450","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-5450","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5450","date":"2026-10-28","epss":0.00502,"percentile":0.42855}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5450"},"relatedVulnerabilities":[{"id":"CVE-2026-5450","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5450","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-5450","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5450","date":"2026-10-28","epss":0.00502,"percentile":0.42855}],"urls":["https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5450","description":"Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow."}]},{"artifact":{"id":"8cb74e3775c9e438","cpes":["cpe:2.3:a:locales:locales:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.31-0ubuntu9.18?arch=all&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5450","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5450","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5450","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-5450","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5450","date":"2026-10-28","epss":0.00502,"percentile":0.42855}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5450"},"relatedVulnerabilities":[{"id":"CVE-2026-5450","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5450","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-5450","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5450","date":"2026-10-28","epss":0.00502,"percentile":0.42855}],"urls":["https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5450","description":"Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42496","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-10-28","epss":0.00502,"percentile":0.42827}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42496"},"relatedVulnerabilities":[{"id":"CVE-2026-42496","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-10-28","epss":0.00502,"percentile":0.42827}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42497","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30852","https://access.redhat.com/errata/RHSA-2026:30856","https://access.redhat.com/errata/RHSA-2026:30857","https://access.redhat.com/security/cve/CVE-2026-42496","https://bugzilla.redhat.com/show_bug.cgi?id=2481314","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42496","description":"Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42496","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-10-28","epss":0.00502,"percentile":0.42827}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42496"},"relatedVulnerabilities":[{"id":"CVE-2026-42496","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-10-28","epss":0.00502,"percentile":0.42827}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42497","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30852","https://access.redhat.com/errata/RHSA-2026:30856","https://access.redhat.com/errata/RHSA-2026:30857","https://access.redhat.com/security/cve/CVE-2026-42496","https://bugzilla.redhat.com/show_bug.cgi?id=2481314","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42496","description":"Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42496","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-10-28","epss":0.00502,"percentile":0.42827}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42496"},"relatedVulnerabilities":[{"id":"CVE-2026-42496","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-10-28","epss":0.00502,"percentile":0.42827}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42497","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30852","https://access.redhat.com/errata/RHSA-2026:30856","https://access.redhat.com/errata/RHSA-2026:30857","https://access.redhat.com/security/cve/CVE-2026-42496","https://bugzilla.redhat.com/show_bug.cgi?id=2481314","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42496","description":"Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42496","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-10-28","epss":0.00502,"percentile":0.42827}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42496"},"relatedVulnerabilities":[{"id":"CVE-2026-42496","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-10-28","epss":0.00502,"percentile":0.42827}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42497","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30852","https://access.redhat.com/errata/RHSA-2026:30856","https://access.redhat.com/errata/RHSA-2026:30857","https://access.redhat.com/security/cve/CVE-2026-42496","https://bugzilla.redhat.com/show_bug.cgi?id=2481314","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42496","description":"Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path."}]},{"artifact":{"id":"bfe6694a44340acd","cpes":["cpe:2.3:a:libssh-4:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh-4:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*"],"name":"libssh-4","purl":"pkg:deb/ubuntu/libssh-4@0.9.3-2ubuntu2.5?arch=amd64&distro=ubuntu-20.04&upstream=libssh","type":"deb","version":"0.9.3-2ubuntu2.5","language":"","licenses":["BSD-2-clause","BSD-3-clause","LGPL-2.1","LGPL-2.1+~OpenSSL","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh-4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssh-4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5372","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libssh","version":"0.9.3-2ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-5372","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-5372","cwe":"CWE-682","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5372","date":"2026-10-28","epss":0.00501,"percentile":0.42777}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-5372"},"relatedVulnerabilities":[{"id":"CVE-2025-5372","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5372","cwe":"CWE-682","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5372","date":"2026-10-28","epss":0.00501,"percentile":0.42777}],"urls":["https://access.redhat.com/errata/RHSA-2025:21977","https://access.redhat.com/errata/RHSA-2025:23024","https://access.redhat.com/errata/RHSA-2026:20610","https://access.redhat.com/errata/RHSA-2026:24349","https://access.redhat.com/errata/RHSA-2026:25911","https://access.redhat.com/security/cve/CVE-2025-5372","https://bugzilla.redhat.com/show_bug.cgi?id=2369388"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5372","description":"A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-41411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-41411","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-41411","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41411","date":"2026-10-28","epss":0.00501,"percentile":0.42752}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-41411"},"relatedVulnerabilities":[{"id":"CVE-2026-41411","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41411","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41411","date":"2026-10-28","epss":0.00501,"percentile":0.42752}],"urls":["https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb","https://github.com/vim/vim/releases/tag/v9.2.0357","https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41411","description":"Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-41411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-41411","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-41411","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41411","date":"2026-10-28","epss":0.00501,"percentile":0.42752}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-41411"},"relatedVulnerabilities":[{"id":"CVE-2026-41411","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41411","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41411","date":"2026-10-28","epss":0.00501,"percentile":0.42752}],"urls":["https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb","https://github.com/vim/vim/releases/tag/v9.2.0357","https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41411","description":"Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-41411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-41411","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-41411","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41411","date":"2026-10-28","epss":0.00501,"percentile":0.42752}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-41411"},"relatedVulnerabilities":[{"id":"CVE-2026-41411","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41411","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41411","date":"2026-10-28","epss":0.00501,"percentile":0.42752}],"urls":["https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb","https://github.com/vim/vim/releases/tag/v9.2.0357","https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41411","description":"Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user."}]},{"artifact":{"id":"34f967921c09dcd9","cpes":["cpe:2.3:a:curl:curl:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8927","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8927","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-28","epss":0.005,"percentile":0.42748}],"risk":0.25,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8927"},"relatedVulnerabilities":[{"id":"CVE-2026-8927","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-28","epss":0.005,"percentile":0.42748}],"urls":["https://curl.se/docs/CVE-2026-8927.html","https://curl.se/docs/CVE-2026-8927.json","https://hackerone.com/reports/3744543"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`."}]},{"artifact":{"id":"bf88a5f755934444","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8927","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8927","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-28","epss":0.005,"percentile":0.42748}],"risk":0.25,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8927"},"relatedVulnerabilities":[{"id":"CVE-2026-8927","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-28","epss":0.005,"percentile":0.42748}],"urls":["https://curl.se/docs/CVE-2026-8927.html","https://curl.se/docs/CVE-2026-8927.json","https://hackerone.com/reports/3744543"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`."}]},{"artifact":{"id":"25fcf12ace6abd0f","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8927","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8927","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-28","epss":0.005,"percentile":0.42748}],"risk":0.25,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8927"},"relatedVulnerabilities":[{"id":"CVE-2026-8927","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-28","epss":0.005,"percentile":0.42748}],"urls":["https://curl.se/docs/CVE-2026-8927.html","https://curl.se/docs/CVE-2026-8927.json","https://hackerone.com/reports/3744543"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-40909","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-40909","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-10-28","epss":0.00499,"percentile":0.42648}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-40909"},"relatedVulnerabilities":[{"id":"CVE-2025-40909","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-10-28","epss":0.00499,"percentile":0.42648}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226","https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e","https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch","https://github.com/Perl/perl5/issues/10387","https://github.com/Perl/perl5/issues/23010","https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads","https://www.openwall.com/lists/oss-security/2025/05/22/2","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/54","http://seclists.org/fulldisclosure/2025/Sep/55","http://www.openwall.com/lists/oss-security/2025/05/23/1","http://www.openwall.com/lists/oss-security/2025/05/30/4","http://www.openwall.com/lists/oss-security/2025/06/02/2","http://www.openwall.com/lists/oss-security/2025/06/02/5","http://www.openwall.com/lists/oss-security/2025/06/02/6","http://www.openwall.com/lists/oss-security/2025/06/02/7","http://www.openwall.com/lists/oss-security/2025/06/03/1","https://lists.debian.org/debian-lts-announce/2026/04/msg00018.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-40909","description":"Perl threads have a working directory race condition where file operations may target unintended paths.\n\nIf a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. \n\nThis may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.\n\nThe bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6"}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-40909","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-40909","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-10-28","epss":0.00499,"percentile":0.42648}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-40909"},"relatedVulnerabilities":[{"id":"CVE-2025-40909","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-10-28","epss":0.00499,"percentile":0.42648}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226","https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e","https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch","https://github.com/Perl/perl5/issues/10387","https://github.com/Perl/perl5/issues/23010","https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads","https://www.openwall.com/lists/oss-security/2025/05/22/2","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/54","http://seclists.org/fulldisclosure/2025/Sep/55","http://www.openwall.com/lists/oss-security/2025/05/23/1","http://www.openwall.com/lists/oss-security/2025/05/30/4","http://www.openwall.com/lists/oss-security/2025/06/02/2","http://www.openwall.com/lists/oss-security/2025/06/02/5","http://www.openwall.com/lists/oss-security/2025/06/02/6","http://www.openwall.com/lists/oss-security/2025/06/02/7","http://www.openwall.com/lists/oss-security/2025/06/03/1","https://lists.debian.org/debian-lts-announce/2026/04/msg00018.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-40909","description":"Perl threads have a working directory race condition where file operations may target unintended paths.\n\nIf a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. \n\nThis may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.\n\nThe bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6"}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-40909","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-40909","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-10-28","epss":0.00499,"percentile":0.42648}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-40909"},"relatedVulnerabilities":[{"id":"CVE-2025-40909","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-10-28","epss":0.00499,"percentile":0.42648}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226","https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e","https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch","https://github.com/Perl/perl5/issues/10387","https://github.com/Perl/perl5/issues/23010","https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads","https://www.openwall.com/lists/oss-security/2025/05/22/2","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/54","http://seclists.org/fulldisclosure/2025/Sep/55","http://www.openwall.com/lists/oss-security/2025/05/23/1","http://www.openwall.com/lists/oss-security/2025/05/30/4","http://www.openwall.com/lists/oss-security/2025/06/02/2","http://www.openwall.com/lists/oss-security/2025/06/02/5","http://www.openwall.com/lists/oss-security/2025/06/02/6","http://www.openwall.com/lists/oss-security/2025/06/02/7","http://www.openwall.com/lists/oss-security/2025/06/03/1","https://lists.debian.org/debian-lts-announce/2026/04/msg00018.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-40909","description":"Perl threads have a working directory race condition where file operations may target unintended paths.\n\nIf a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. \n\nThis may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.\n\nThe bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6"}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-40909","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-40909","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-10-28","epss":0.00499,"percentile":0.42648}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-40909"},"relatedVulnerabilities":[{"id":"CVE-2025-40909","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-10-28","epss":0.00499,"percentile":0.42648}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226","https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e","https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch","https://github.com/Perl/perl5/issues/10387","https://github.com/Perl/perl5/issues/23010","https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads","https://www.openwall.com/lists/oss-security/2025/05/22/2","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/54","http://seclists.org/fulldisclosure/2025/Sep/55","http://www.openwall.com/lists/oss-security/2025/05/23/1","http://www.openwall.com/lists/oss-security/2025/05/30/4","http://www.openwall.com/lists/oss-security/2025/06/02/2","http://www.openwall.com/lists/oss-security/2025/06/02/5","http://www.openwall.com/lists/oss-security/2025/06/02/6","http://www.openwall.com/lists/oss-security/2025/06/02/7","http://www.openwall.com/lists/oss-security/2025/06/03/1","https://lists.debian.org/debian-lts-announce/2026/04/msg00018.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-40909","description":"Perl threads have a working directory race condition where file operations may target unintended paths.\n\nIf a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. \n\nThis may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.\n\nThe bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6"}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3644","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3644","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3644","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-3644","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3644","date":"2026-10-28","epss":0.00497,"percentile":0.42482}],"risk":0.24849999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3644"},"relatedVulnerabilities":[{"id":"CVE-2026-3644","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3644","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-3644","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3644","date":"2026-10-28","epss":0.00497,"percentile":0.42482}],"urls":["https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330","https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8","https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4","https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd","https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd","https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef","https://github.com/python/cpython/issues/145599","https://github.com/python/cpython/pull/145600","https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3644","description":"The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output()."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3644","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3644","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3644","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-3644","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3644","date":"2026-10-28","epss":0.00497,"percentile":0.42482}],"risk":0.24849999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3644"},"relatedVulnerabilities":[{"id":"CVE-2026-3644","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3644","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-3644","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3644","date":"2026-10-28","epss":0.00497,"percentile":0.42482}],"urls":["https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330","https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8","https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4","https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd","https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd","https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef","https://github.com/python/cpython/issues/145599","https://github.com/python/cpython/pull/145600","https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3644","description":"The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output()."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-3644","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3644","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3644","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-3644","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3644","date":"2026-10-28","epss":0.00497,"percentile":0.42482}],"risk":0.24849999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3644"},"relatedVulnerabilities":[{"id":"CVE-2026-3644","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3644","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-3644","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3644","date":"2026-10-28","epss":0.00497,"percentile":0.42482}],"urls":["https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330","https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8","https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4","https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd","https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd","https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef","https://github.com/python/cpython/issues/145599","https://github.com/python/cpython/pull/145600","https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3644","description":"The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output()."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3644","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3644","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3644","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-3644","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3644","date":"2026-10-28","epss":0.00497,"percentile":0.42482}],"risk":0.24849999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3644"},"relatedVulnerabilities":[{"id":"CVE-2026-3644","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3644","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-3644","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3644","date":"2026-10-28","epss":0.00497,"percentile":0.42482}],"urls":["https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330","https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8","https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4","https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd","https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd","https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef","https://github.com/python/cpython/issues/145599","https://github.com/python/cpython/pull/145600","https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3644","description":"The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output()."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-13221","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-28","epss":0.00494,"percentile":0.42295}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13221"},"relatedVulnerabilities":[{"id":"CVE-2026-13221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-28","epss":0.00494,"percentile":0.42295}],"urls":["https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch","https://github.com/Perl/perl5/issues/23388","http://www.openwall.com/lists/oss-security/2026/07/13/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13221","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-13221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-13221","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-28","epss":0.00494,"percentile":0.42295}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13221"},"relatedVulnerabilities":[{"id":"CVE-2026-13221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-28","epss":0.00494,"percentile":0.42295}],"urls":["https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch","https://github.com/Perl/perl5/issues/23388","http://www.openwall.com/lists/oss-security/2026/07/13/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13221","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-13221","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-28","epss":0.00494,"percentile":0.42295}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13221"},"relatedVulnerabilities":[{"id":"CVE-2026-13221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-28","epss":0.00494,"percentile":0.42295}],"urls":["https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch","https://github.com/Perl/perl5/issues/23388","http://www.openwall.com/lists/oss-security/2026/07/13/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13221","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-13221","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-28","epss":0.00494,"percentile":0.42295}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13221"},"relatedVulnerabilities":[{"id":"CVE-2026-13221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-28","epss":0.00494,"percentile":0.42295}],"urls":["https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch","https://github.com/Perl/perl5/issues/23388","http://www.openwall.com/lists/oss-security/2026/07/13/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13221","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong."}]},{"artifact":{"id":"0173539095d733d0","cpes":["cpe:2.3:a:wget:wget:1.20.3-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/ubuntu/wget@1.20.3-1ubuntu2.1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.20.3-1ubuntu2.1","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-58469","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"wget","version":"1.20.3-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-58469","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58469","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58469","date":"2026-10-28","epss":0.00493,"percentile":0.42227}],"risk":0.24650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58469"},"relatedVulnerabilities":[{"id":"CVE-2026-58469","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58469","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58469","date":"2026-10-28","epss":0.00493,"percentile":0.42227}],"urls":["https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826","https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-underread-via-metalink-url-parsing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58469","description":"GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior."}]},{"artifact":{"id":"9ad028a9a47a9fb7","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15281","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15281","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-15281","date":"2026-10-28","epss":0.00491,"percentile":0.42093}],"risk":0.24550000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15281"},"relatedVulnerabilities":[{"id":"CVE-2025-15281","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-15281","date":"2026-10-28","epss":0.00491,"percentile":0.42093}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33814","http://www.openwall.com/lists/oss-security/2026/01/20/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15281","description":"Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process."}]},{"artifact":{"id":"c4143394e9032e2d","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.17:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.17?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.17","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15281","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.17"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15281","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-15281","date":"2026-10-28","epss":0.00491,"percentile":0.42093}],"risk":0.24550000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15281"},"relatedVulnerabilities":[{"id":"CVE-2025-15281","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-15281","date":"2026-10-28","epss":0.00491,"percentile":0.42093}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33814","http://www.openwall.com/lists/oss-security/2026/01/20/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15281","description":"Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process."}]},{"artifact":{"id":"8cb74e3775c9e438","cpes":["cpe:2.3:a:locales:locales:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.31-0ubuntu9.18?arch=all&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15281","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15281","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-15281","date":"2026-10-28","epss":0.00491,"percentile":0.42093}],"risk":0.24550000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15281"},"relatedVulnerabilities":[{"id":"CVE-2025-15281","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-15281","date":"2026-10-28","epss":0.00491,"percentile":0.42093}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33814","http://www.openwall.com/lists/oss-security/2026/01/20/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15281","description":"Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process."}]},{"artifact":{"id":"c98e6dac9c14f84d","cpes":["cpe:2.3:a:tar:tar:1.30\\+dfsg-7ubuntu0.20.04.4:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/ubuntu/tar@1.30%2Bdfsg-7ubuntu0.20.04.4?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.30+dfsg-7ubuntu0.20.04.4","language":"","licenses":["sha256:9292780f2dfd11900e92ea67c7a316cf9df740b955956f87ec099a5b4f3d9136"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-45582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"tar","version":"1.30+dfsg-7ubuntu0.20.04.4"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-45582","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-45582","cwe":"CWE-24","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-45582","date":"2026-10-28","epss":0.0049,"percentile":0.42015}],"risk":0.245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-45582"},"relatedVulnerabilities":[{"id":"CVE-2025-45582","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L","metrics":{"baseScore":4.1,"impactScore":2.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-45582","cwe":"CWE-24","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-45582","date":"2026-10-28","epss":0.0049,"percentile":0.42015}],"urls":["https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md","https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html","https://www.gnu.org/software/tar/","https://www.gnu.org/software/tar/manual/html_node/Integrity.html","https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html","http://www.openwall.com/lists/oss-security/2025/11/01/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-45582","description":"GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of \"Member name contains '..'\" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain \"x -> ../../../../../home/victim/.ssh\" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which \"tar xf\" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each \"tar xf\" in its Security Rules of Thumb; however, third-party advice leads users to run \"tar xf\" more than once into the same directory."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8376","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-10-28","epss":0.00486,"percentile":0.41756}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8376"},"relatedVulnerabilities":[{"id":"CVE-2026-8376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-10-28","epss":0.00486,"percentile":0.41756}],"urls":["https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch","http://www.openwall.com/lists/oss-security/2026/05/26/1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8376","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8376","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-10-28","epss":0.00486,"percentile":0.41756}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8376"},"relatedVulnerabilities":[{"id":"CVE-2026-8376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-10-28","epss":0.00486,"percentile":0.41756}],"urls":["https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch","http://www.openwall.com/lists/oss-security/2026/05/26/1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8376","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8376","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-10-28","epss":0.00486,"percentile":0.41756}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8376"},"relatedVulnerabilities":[{"id":"CVE-2026-8376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-10-28","epss":0.00486,"percentile":0.41756}],"urls":["https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch","http://www.openwall.com/lists/oss-security/2026/05/26/1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8376","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8376","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-10-28","epss":0.00486,"percentile":0.41756}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8376"},"relatedVulnerabilities":[{"id":"CVE-2026-8376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-10-28","epss":0.00486,"percentile":0.41756}],"urls":["https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch","http://www.openwall.com/lists/oss-security/2026/05/26/1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8376","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-10-28","epss":0.00486,"percentile":0.41735}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3276"},"relatedVulnerabilities":[{"id":"CVE-2026-3276","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-10-28","epss":0.00486,"percentile":0.41735}],"urls":["https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0","https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598","https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f","https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32","https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066","https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f","https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc","https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c","https://github.com/python/cpython/issues/149079","https://github.com/python/cpython/pull/149080","https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/","http://www.openwall.com/lists/oss-security/2026/06/03/15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3276","description":"unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-10-28","epss":0.00486,"percentile":0.41735}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3276"},"relatedVulnerabilities":[{"id":"CVE-2026-3276","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-10-28","epss":0.00486,"percentile":0.41735}],"urls":["https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0","https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598","https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f","https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32","https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066","https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f","https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc","https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c","https://github.com/python/cpython/issues/149079","https://github.com/python/cpython/pull/149080","https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/","http://www.openwall.com/lists/oss-security/2026/06/03/15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3276","description":"unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-3276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-10-28","epss":0.00486,"percentile":0.41735}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3276"},"relatedVulnerabilities":[{"id":"CVE-2026-3276","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-10-28","epss":0.00486,"percentile":0.41735}],"urls":["https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0","https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598","https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f","https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32","https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066","https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f","https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc","https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c","https://github.com/python/cpython/issues/149079","https://github.com/python/cpython/pull/149080","https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/","http://www.openwall.com/lists/oss-security/2026/06/03/15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3276","description":"unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-10-28","epss":0.00486,"percentile":0.41735}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3276"},"relatedVulnerabilities":[{"id":"CVE-2026-3276","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-10-28","epss":0.00486,"percentile":0.41735}],"urls":["https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0","https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598","https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f","https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32","https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066","https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f","https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc","https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c","https://github.com/python/cpython/issues/149079","https://github.com/python/cpython/pull/149080","https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/","http://www.openwall.com/lists/oss-security/2026/06/03/15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3276","description":"unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-10-28","epss":0.00805,"percentile":0.56618}],"risk":0.2415,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28389"},"relatedVulnerabilities":[{"id":"CVE-2026-28389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-10-28","epss":0.00805,"percentile":0.56618}],"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28390","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28390","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28390","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28390","date":"2026-10-28","epss":0.00805,"percentile":0.56618}],"risk":0.2415,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28390"},"relatedVulnerabilities":[{"id":"CVE-2026-28390","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28390","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28390","date":"2026-10-28","epss":0.00805,"percentile":0.56618}],"urls":["https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-10-28","epss":0.00805,"percentile":0.56618}],"risk":0.2415,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28389"},"relatedVulnerabilities":[{"id":"CVE-2026-28389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-10-28","epss":0.00805,"percentile":0.56618}],"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28390","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28390","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28390","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28390","date":"2026-10-28","epss":0.00805,"percentile":0.56618}],"risk":0.2415,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28390"},"relatedVulnerabilities":[{"id":"CVE-2026-28390","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28390","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28390","date":"2026-10-28","epss":0.00805,"percentile":0.56618}],"urls":["https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7383","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7383","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-10-28","epss":0.00804,"percentile":0.566}],"risk":0.2412,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7383"},"relatedVulnerabilities":[{"id":"CVE-2026-7383","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-10-28","epss":0.00804,"percentile":0.566}],"urls":["https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6","https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74","https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974","https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083","https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","description":"Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7383","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7383","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-10-28","epss":0.00804,"percentile":0.566}],"risk":0.2412,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7383"},"relatedVulnerabilities":[{"id":"CVE-2026-7383","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-10-28","epss":0.00804,"percentile":0.566}],"urls":["https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6","https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74","https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974","https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083","https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","description":"Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4010","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4010","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47912","date":"2026-10-28","epss":0.00468,"percentile":0.40379}],"risk":0.24101999999999998,"urls":["https://go.dev/cl/709857","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75678","description":"The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."},"relatedVulnerabilities":[{"id":"CVE-2025-47912","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47912","date":"2026-10-28","epss":0.00468,"percentile":0.40379}],"urls":["https://go.dev/cl/709857","https://go.dev/issue/75678","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4010","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47912","description":"The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4008","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4008","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58189","cwe":"CWE-532","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58189","date":"2026-10-28","epss":0.00468,"percentile":0.40378}],"risk":0.24101999999999998,"urls":["https://go.dev/issue/75652","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/707776","description":"When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped."},"relatedVulnerabilities":[{"id":"CVE-2025-58189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58189","cwe":"CWE-532","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58189","date":"2026-10-28","epss":0.00468,"percentile":0.40378}],"urls":["https://go.dev/cl/707776","https://go.dev/issue/75652","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4008","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58189","description":"When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0672","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0672","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0672","date":"2026-10-28","epss":0.0048,"percentile":0.41292}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0672"},"relatedVulnerabilities":[{"id":"CVE-2026-0672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0672","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0672","date":"2026-10-28","epss":0.0048,"percentile":0.41292}],"urls":["https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172","https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440","https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d","https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca","https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70","https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85","https://github.com/python/cpython/issues/143919","https://github.com/python/cpython/pull/143920","https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0672","description":"When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0672","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0672","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0672","date":"2026-10-28","epss":0.0048,"percentile":0.41292}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0672"},"relatedVulnerabilities":[{"id":"CVE-2026-0672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0672","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0672","date":"2026-10-28","epss":0.0048,"percentile":0.41292}],"urls":["https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172","https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440","https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d","https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca","https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70","https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85","https://github.com/python/cpython/issues/143919","https://github.com/python/cpython/pull/143920","https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0672","description":"When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0672","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0672","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0672","date":"2026-10-28","epss":0.0048,"percentile":0.41292}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0672"},"relatedVulnerabilities":[{"id":"CVE-2026-0672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0672","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0672","date":"2026-10-28","epss":0.0048,"percentile":0.41292}],"urls":["https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172","https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440","https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d","https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca","https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70","https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85","https://github.com/python/cpython/issues/143919","https://github.com/python/cpython/pull/143920","https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0672","description":"When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0672","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0672","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0672","date":"2026-10-28","epss":0.0048,"percentile":0.41292}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0672"},"relatedVulnerabilities":[{"id":"CVE-2026-0672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0672","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0672","date":"2026-10-28","epss":0.0048,"percentile":0.41292}],"urls":["https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172","https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440","https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d","https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca","https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70","https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85","https://github.com/python/cpython/issues/143919","https://github.com/python/cpython/pull/143920","https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0672","description":"When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters."}]},{"artifact":{"id":"198ee162877e76c2","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.9-1ubuntu0.8:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.2.9-1ubuntu0.8?arch=amd64&distro=ubuntu-20.04&upstream=expat","type":"deb","version":"2.2.9-1ubuntu0.8","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"expat","version":"2.2.9-1ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-45186","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45186","cwe":"CWE-407","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-45186","cwe":"CWE-407","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45186","date":"2026-10-28","epss":0.00479,"percentile":0.41244}],"risk":0.2395,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45186"},"relatedVulnerabilities":[{"id":"CVE-2026-45186","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45186","cwe":"CWE-407","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-45186","cwe":"CWE-407","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45186","date":"2026-10-28","epss":0.00479,"percentile":0.41244}],"urls":["https://github.com/libexpat/libexpat/pull/1216","http://www.openwall.com/lists/oss-security/2026/05/11/16","https://access.redhat.com/errata/RHSA-2026:22715","https://access.redhat.com/errata/RHSA-2026:22721","https://access.redhat.com/errata/RHSA-2026:23230","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:27201","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/security/cve/CVE-2026-45186","https://bugzilla.redhat.com/show_bug.cgi?id=2468575","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45186","description":"In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42011","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42011","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42011","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42011","date":"2026-10-28","epss":0.00475,"percentile":0.40948}],"risk":0.2375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42011"},"relatedVulnerabilities":[{"id":"CVE-2026-42011","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42011","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42011","date":"2026-10-28","epss":0.00475,"percentile":0.40948}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:43575","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42011","https://bugzilla.redhat.com/show_bug.cgi?id=2467437","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42011","description":"A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-57433","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-28","epss":0.00475,"percentile":0.40942}],"risk":0.2375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57433"},"relatedVulnerabilities":[{"id":"CVE-2026-57433","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-28","epss":0.00475,"percentile":0.40942}],"urls":["https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","http://www.openwall.com/lists/oss-security/2026/07/13/7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-57433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-57433","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-28","epss":0.00475,"percentile":0.40942}],"risk":0.2375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57433"},"relatedVulnerabilities":[{"id":"CVE-2026-57433","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-28","epss":0.00475,"percentile":0.40942}],"urls":["https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","http://www.openwall.com/lists/oss-security/2026/07/13/7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-57433","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-28","epss":0.00475,"percentile":0.40942}],"risk":0.2375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57433"},"relatedVulnerabilities":[{"id":"CVE-2026-57433","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-28","epss":0.00475,"percentile":0.40942}],"urls":["https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","http://www.openwall.com/lists/oss-security/2026/07/13/7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-57433","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-28","epss":0.00475,"percentile":0.40942}],"risk":0.2375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57433"},"relatedVulnerabilities":[{"id":"CVE-2026-57433","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-28","epss":0.00475,"percentile":0.40942}],"urls":["https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","http://www.openwall.com/lists/oss-security/2026/07/13/7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}]},{"artifact":{"id":"198ee162877e76c2","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.9-1ubuntu0.8:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.2.9-1ubuntu0.8?arch=amd64&distro=ubuntu-20.04&upstream=expat","type":"deb","version":"2.2.9-1ubuntu0.8","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113351","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"expat","version":"2.2.9-1ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-113351","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-10-28","epss":0.00474,"percentile":0.40862}],"risk":0.23700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-113351"},"relatedVulnerabilities":[{"id":"CVE-2026-113351","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-10-28","epss":0.00474,"percentile":0.40862}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884","https://github.com/libexpat/libexpat/pull/1431","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","description":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated."}]},{"artifact":{"id":"34f967921c09dcd9","cpes":["cpe:2.3:a:curl:curl:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-3783","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3783","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3783","date":"2026-10-28","epss":0.00473,"percentile":0.40779}],"risk":0.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3783"},"relatedVulnerabilities":[{"id":"CVE-2026-3783","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3783","date":"2026-10-28","epss":0.00473,"percentile":0.40779}],"urls":["https://curl.se/docs/CVE-2026-3783.html","https://curl.se/docs/CVE-2026-3783.json","https://hackerone.com/reports/3583983","http://www.openwall.com/lists/oss-security/2026/03/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3783","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one."}]},{"artifact":{"id":"bf88a5f755934444","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3783","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3783","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3783","date":"2026-10-28","epss":0.00473,"percentile":0.40779}],"risk":0.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3783"},"relatedVulnerabilities":[{"id":"CVE-2026-3783","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3783","date":"2026-10-28","epss":0.00473,"percentile":0.40779}],"urls":["https://curl.se/docs/CVE-2026-3783.html","https://curl.se/docs/CVE-2026-3783.json","https://hackerone.com/reports/3583983","http://www.openwall.com/lists/oss-security/2026/03/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3783","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one."}]},{"artifact":{"id":"25fcf12ace6abd0f","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3783","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3783","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3783","date":"2026-10-28","epss":0.00473,"percentile":0.40779}],"risk":0.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3783"},"relatedVulnerabilities":[{"id":"CVE-2026-3783","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3783","date":"2026-10-28","epss":0.00473,"percentile":0.40779}],"urls":["https://curl.se/docs/CVE-2026-3783.html","https://curl.se/docs/CVE-2026-3783.json","https://hackerone.com/reports/3583983","http://www.openwall.com/lists/oss-security/2026/03/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3783","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one."}]},{"artifact":{"id":"675f3769b731031e","cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*"],"name":"libpam-modules","purl":"pkg:deb/ubuntu/libpam-modules@1.3.1-5ubuntu4.7?arch=amd64&distro=ubuntu-20.04&upstream=pam","type":"deb","version":"1.3.1-5ubuntu4.7","language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6020","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pam","version":"1.3.1-5ubuntu4.7"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6020","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-10-28","epss":0.00472,"percentile":0.40687}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6020"},"relatedVulnerabilities":[{"id":"CVE-2025-6020","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-10-28","epss":0.00472,"percentile":0.40687}],"urls":["https://access.redhat.com/errata/RHSA-2025:10024","https://access.redhat.com/errata/RHSA-2025:10027","https://access.redhat.com/errata/RHSA-2025:10180","https://access.redhat.com/errata/RHSA-2025:10354","https://access.redhat.com/errata/RHSA-2025:10357","https://access.redhat.com/errata/RHSA-2025:10358","https://access.redhat.com/errata/RHSA-2025:10359","https://access.redhat.com/errata/RHSA-2025:10361","https://access.redhat.com/errata/RHSA-2025:10362","https://access.redhat.com/errata/RHSA-2025:10735","https://access.redhat.com/errata/RHSA-2025:10823","https://access.redhat.com/errata/RHSA-2025:11386","https://access.redhat.com/errata/RHSA-2025:11487","https://access.redhat.com/errata/RHSA-2025:14557","https://access.redhat.com/errata/RHSA-2025:15099","https://access.redhat.com/errata/RHSA-2025:15709","https://access.redhat.com/errata/RHSA-2025:15827","https://access.redhat.com/errata/RHSA-2025:15828","https://access.redhat.com/errata/RHSA-2025:16524","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:18219","https://access.redhat.com/errata/RHSA-2025:20181","https://access.redhat.com/errata/RHSA-2025:21885","https://access.redhat.com/errata/RHSA-2025:22019","https://access.redhat.com/errata/RHSA-2025:9526","https://access.redhat.com/errata/RHSA-2026:0934","https://access.redhat.com/security/cve/CVE-2025-6020","https://bugzilla.redhat.com/show_bug.cgi?id=2372512","https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx","http://www.openwall.com/lists/oss-security/2025/06/17/1","https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6020","description":"A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions."}]},{"artifact":{"id":"7bbc781302c446e0","cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*"],"name":"libpam-modules-bin","purl":"pkg:deb/ubuntu/libpam-modules-bin@1.3.1-5ubuntu4.7?arch=amd64&distro=ubuntu-20.04&upstream=pam","type":"deb","version":"1.3.1-5ubuntu4.7","language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6020","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pam","version":"1.3.1-5ubuntu4.7"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6020","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-10-28","epss":0.00472,"percentile":0.40687}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6020"},"relatedVulnerabilities":[{"id":"CVE-2025-6020","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-10-28","epss":0.00472,"percentile":0.40687}],"urls":["https://access.redhat.com/errata/RHSA-2025:10024","https://access.redhat.com/errata/RHSA-2025:10027","https://access.redhat.com/errata/RHSA-2025:10180","https://access.redhat.com/errata/RHSA-2025:10354","https://access.redhat.com/errata/RHSA-2025:10357","https://access.redhat.com/errata/RHSA-2025:10358","https://access.redhat.com/errata/RHSA-2025:10359","https://access.redhat.com/errata/RHSA-2025:10361","https://access.redhat.com/errata/RHSA-2025:10362","https://access.redhat.com/errata/RHSA-2025:10735","https://access.redhat.com/errata/RHSA-2025:10823","https://access.redhat.com/errata/RHSA-2025:11386","https://access.redhat.com/errata/RHSA-2025:11487","https://access.redhat.com/errata/RHSA-2025:14557","https://access.redhat.com/errata/RHSA-2025:15099","https://access.redhat.com/errata/RHSA-2025:15709","https://access.redhat.com/errata/RHSA-2025:15827","https://access.redhat.com/errata/RHSA-2025:15828","https://access.redhat.com/errata/RHSA-2025:16524","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:18219","https://access.redhat.com/errata/RHSA-2025:20181","https://access.redhat.com/errata/RHSA-2025:21885","https://access.redhat.com/errata/RHSA-2025:22019","https://access.redhat.com/errata/RHSA-2025:9526","https://access.redhat.com/errata/RHSA-2026:0934","https://access.redhat.com/security/cve/CVE-2025-6020","https://bugzilla.redhat.com/show_bug.cgi?id=2372512","https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx","http://www.openwall.com/lists/oss-security/2025/06/17/1","https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6020","description":"A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions."}]},{"artifact":{"id":"b1941eab59e8cd62","cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*"],"name":"libpam-runtime","purl":"pkg:deb/ubuntu/libpam-runtime@1.3.1-5ubuntu4.7?arch=all&distro=ubuntu-20.04&upstream=pam","type":"deb","version":"1.3.1-5ubuntu4.7","language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6020","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pam","version":"1.3.1-5ubuntu4.7"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6020","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-10-28","epss":0.00472,"percentile":0.40687}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6020"},"relatedVulnerabilities":[{"id":"CVE-2025-6020","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-10-28","epss":0.00472,"percentile":0.40687}],"urls":["https://access.redhat.com/errata/RHSA-2025:10024","https://access.redhat.com/errata/RHSA-2025:10027","https://access.redhat.com/errata/RHSA-2025:10180","https://access.redhat.com/errata/RHSA-2025:10354","https://access.redhat.com/errata/RHSA-2025:10357","https://access.redhat.com/errata/RHSA-2025:10358","https://access.redhat.com/errata/RHSA-2025:10359","https://access.redhat.com/errata/RHSA-2025:10361","https://access.redhat.com/errata/RHSA-2025:10362","https://access.redhat.com/errata/RHSA-2025:10735","https://access.redhat.com/errata/RHSA-2025:10823","https://access.redhat.com/errata/RHSA-2025:11386","https://access.redhat.com/errata/RHSA-2025:11487","https://access.redhat.com/errata/RHSA-2025:14557","https://access.redhat.com/errata/RHSA-2025:15099","https://access.redhat.com/errata/RHSA-2025:15709","https://access.redhat.com/errata/RHSA-2025:15827","https://access.redhat.com/errata/RHSA-2025:15828","https://access.redhat.com/errata/RHSA-2025:16524","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:18219","https://access.redhat.com/errata/RHSA-2025:20181","https://access.redhat.com/errata/RHSA-2025:21885","https://access.redhat.com/errata/RHSA-2025:22019","https://access.redhat.com/errata/RHSA-2025:9526","https://access.redhat.com/errata/RHSA-2026:0934","https://access.redhat.com/security/cve/CVE-2025-6020","https://bugzilla.redhat.com/show_bug.cgi?id=2372512","https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx","http://www.openwall.com/lists/oss-security/2025/06/17/1","https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6020","description":"A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions."}]},{"artifact":{"id":"55b776a7ae80291d","cpes":["cpe:2.3:a:libpam0g:libpam0g:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*"],"name":"libpam0g","purl":"pkg:deb/ubuntu/libpam0g@1.3.1-5ubuntu4.7?arch=amd64&distro=ubuntu-20.04&upstream=pam","type":"deb","version":"1.3.1-5ubuntu4.7","language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6020","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pam","version":"1.3.1-5ubuntu4.7"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6020","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-10-28","epss":0.00472,"percentile":0.40687}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6020"},"relatedVulnerabilities":[{"id":"CVE-2025-6020","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-10-28","epss":0.00472,"percentile":0.40687}],"urls":["https://access.redhat.com/errata/RHSA-2025:10024","https://access.redhat.com/errata/RHSA-2025:10027","https://access.redhat.com/errata/RHSA-2025:10180","https://access.redhat.com/errata/RHSA-2025:10354","https://access.redhat.com/errata/RHSA-2025:10357","https://access.redhat.com/errata/RHSA-2025:10358","https://access.redhat.com/errata/RHSA-2025:10359","https://access.redhat.com/errata/RHSA-2025:10361","https://access.redhat.com/errata/RHSA-2025:10362","https://access.redhat.com/errata/RHSA-2025:10735","https://access.redhat.com/errata/RHSA-2025:10823","https://access.redhat.com/errata/RHSA-2025:11386","https://access.redhat.com/errata/RHSA-2025:11487","https://access.redhat.com/errata/RHSA-2025:14557","https://access.redhat.com/errata/RHSA-2025:15099","https://access.redhat.com/errata/RHSA-2025:15709","https://access.redhat.com/errata/RHSA-2025:15827","https://access.redhat.com/errata/RHSA-2025:15828","https://access.redhat.com/errata/RHSA-2025:16524","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:18219","https://access.redhat.com/errata/RHSA-2025:20181","https://access.redhat.com/errata/RHSA-2025:21885","https://access.redhat.com/errata/RHSA-2025:22019","https://access.redhat.com/errata/RHSA-2025:9526","https://access.redhat.com/errata/RHSA-2026:0934","https://access.redhat.com/security/cve/CVE-2025-6020","https://bugzilla.redhat.com/show_bug.cgi?id=2372512","https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx","http://www.openwall.com/lists/oss-security/2025/06/17/1","https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6020","description":"A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-28","epss":0.00472,"percentile":0.4068}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-28","epss":0.00472,"percentile":0.4068}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-28","epss":0.00472,"percentile":0.4068}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-28","epss":0.00472,"percentile":0.4068}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-28","epss":0.00472,"percentile":0.4068}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-28","epss":0.00472,"percentile":0.4068}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-28","epss":0.00472,"percentile":0.4068}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-10-28","epss":0.00472,"percentile":0.4068}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"34f967921c09dcd9","cpes":["cpe:2.3:a:curl:curl:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7168","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-28","epss":0.00471,"percentile":0.40646}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7168"},"relatedVulnerabilities":[{"id":"CVE-2026-7168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-28","epss":0.00471,"percentile":0.40646}],"urls":["https://curl.se/docs/CVE-2026-7168.html","https://curl.se/docs/CVE-2026-7168.json","https://hackerone.com/reports/3697719","http://www.openwall.com/lists/oss-security/2026/04/29/14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."}]},{"artifact":{"id":"bf88a5f755934444","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7168","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-28","epss":0.00471,"percentile":0.40646}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7168"},"relatedVulnerabilities":[{"id":"CVE-2026-7168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-28","epss":0.00471,"percentile":0.40646}],"urls":["https://curl.se/docs/CVE-2026-7168.html","https://curl.se/docs/CVE-2026-7168.json","https://hackerone.com/reports/3697719","http://www.openwall.com/lists/oss-security/2026/04/29/14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."}]},{"artifact":{"id":"25fcf12ace6abd0f","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7168","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-28","epss":0.00471,"percentile":0.40646}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7168"},"relatedVulnerabilities":[{"id":"CVE-2026-7168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-28","epss":0.00471,"percentile":0.40646}],"urls":["https://curl.se/docs/CVE-2026-7168.html","https://curl.se/docs/CVE-2026-7168.json","https://hackerone.com/reports/3697719","http://www.openwall.com/lists/oss-security/2026/04/29/14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."}]},{"artifact":{"id":"86e3707dbf5c5f83","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.11.dfsg-2ubuntu1.5:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/ubuntu/zlib1g@1%3A1.2.11.dfsg-2ubuntu1.5?arch=amd64&distro=ubuntu-20.04&upstream=zlib","type":"deb","version":"1:1.2.11.dfsg-2ubuntu1.5","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"zlib","version":"1:1.2.11.dfsg-2ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-28","epss":0.00469,"percentile":0.4046}],"risk":0.2345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85091"},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-28","epss":0.00469,"percentile":0.4046}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8291","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-8291","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8291","cwe":"CWE-1285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8291","date":"2026-10-28","epss":0.00466,"percentile":0.40264}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8291"},"relatedVulnerabilities":[{"id":"CVE-2025-8291","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8291","cwe":"CWE-1285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8291","date":"2026-10-28","epss":0.00466,"percentile":0.40264}],"urls":["https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267","https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46","https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6","https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196","https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4","https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388","https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3","https://github.com/python/cpython/issues/139700","https://github.com/python/cpython/pull/139702","https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/","https://github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6p","https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8291","description":"The 'zipfile' module would not check the validity of the ZIP64 End of\nCentral Directory (EOCD) Locator record offset value would not be used to\nlocate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be\nassumed to be the previous record in the ZIP archive. This could be abused\nto create ZIP archives that are handled differently by the 'zipfile' module\ncompared to other ZIP implementations.\n\n\nRemediation maintains this behavior, but checks that the offset specified\nin the ZIP64 EOCD Locator record matches the expected value."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8291","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-8291","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8291","cwe":"CWE-1285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8291","date":"2026-10-28","epss":0.00466,"percentile":0.40264}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8291"},"relatedVulnerabilities":[{"id":"CVE-2025-8291","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8291","cwe":"CWE-1285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8291","date":"2026-10-28","epss":0.00466,"percentile":0.40264}],"urls":["https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267","https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46","https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6","https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196","https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4","https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388","https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3","https://github.com/python/cpython/issues/139700","https://github.com/python/cpython/pull/139702","https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/","https://github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6p","https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8291","description":"The 'zipfile' module would not check the validity of the ZIP64 End of\nCentral Directory (EOCD) Locator record offset value would not be used to\nlocate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be\nassumed to be the previous record in the ZIP archive. This could be abused\nto create ZIP archives that are handled differently by the 'zipfile' module\ncompared to other ZIP implementations.\n\n\nRemediation maintains this behavior, but checks that the offset specified\nin the ZIP64 EOCD Locator record matches the expected value."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-8291","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-8291","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8291","cwe":"CWE-1285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8291","date":"2026-10-28","epss":0.00466,"percentile":0.40264}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8291"},"relatedVulnerabilities":[{"id":"CVE-2025-8291","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8291","cwe":"CWE-1285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8291","date":"2026-10-28","epss":0.00466,"percentile":0.40264}],"urls":["https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267","https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46","https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6","https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196","https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4","https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388","https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3","https://github.com/python/cpython/issues/139700","https://github.com/python/cpython/pull/139702","https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/","https://github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6p","https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8291","description":"The 'zipfile' module would not check the validity of the ZIP64 End of\nCentral Directory (EOCD) Locator record offset value would not be used to\nlocate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be\nassumed to be the previous record in the ZIP archive. This could be abused\nto create ZIP archives that are handled differently by the 'zipfile' module\ncompared to other ZIP implementations.\n\n\nRemediation maintains this behavior, but checks that the offset specified\nin the ZIP64 EOCD Locator record matches the expected value."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8291","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-8291","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8291","cwe":"CWE-1285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8291","date":"2026-10-28","epss":0.00466,"percentile":0.40264}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8291"},"relatedVulnerabilities":[{"id":"CVE-2025-8291","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8291","cwe":"CWE-1285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8291","date":"2026-10-28","epss":0.00466,"percentile":0.40264}],"urls":["https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267","https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46","https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6","https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196","https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4","https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388","https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3","https://github.com/python/cpython/issues/139700","https://github.com/python/cpython/pull/139702","https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/","https://github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6p","https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8291","description":"The 'zipfile' module would not check the validity of the ZIP64 End of\nCentral Directory (EOCD) Locator record offset value would not be used to\nlocate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be\nassumed to be the previous record in the ZIP archive. This could be abused\nto create ZIP archives that are handled differently by the 'zipfile' module\ncompared to other ZIP implementations.\n\n\nRemediation maintains this behavior, but checks that the offset specified\nin the ZIP64 EOCD Locator record matches the expected value."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2888","versionConstraint":"<1.21.11||>=1.22.0-0,<1.22.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2888","fix":{"state":"fixed","versions":["1.21.11","1.22.4"],"available":[{"date":"2024-06-04","kind":"release","version":"1.21.11"},{"date":"2024-06-04","kind":"release","version":"1.22.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24789","date":"2026-10-28","epss":0.00443,"percentile":0.38366}],"risk":0.232575,"urls":["https://go.dev/issue/66869","https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/585397","description":"The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors."},"relatedVulnerabilities":[{"id":"CVE-2024-24789","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24789","date":"2026-10-28","epss":0.00443,"percentile":0.38366}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/04/1","https://go.dev/cl/585397","https://go.dev/issue/66869","https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/","https://pkg.go.dev/vuln/GO-2024-2888","https://security.netapp.com/advisory/ntap-20250131-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-24789","description":"The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors."}]},{"artifact":{"id":"bfe6694a44340acd","cpes":["cpe:2.3:a:libssh-4:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh-4:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*"],"name":"libssh-4","purl":"pkg:deb/ubuntu/libssh-4@0.9.3-2ubuntu2.5?arch=amd64&distro=ubuntu-20.04&upstream=libssh","type":"deb","version":"0.9.3-2ubuntu2.5","language":"","licenses":["BSD-2-clause","BSD-3-clause","LGPL-2.1","LGPL-2.1+~OpenSSL","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh-4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssh-4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libssh","version":"0.9.3-2ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0968","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0968","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0968","date":"2026-10-28","epss":0.00459,"percentile":0.3969}],"risk":0.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0968"},"relatedVulnerabilities":[{"id":"CVE-2026-0968","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0968","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0968","date":"2026-10-28","epss":0.00459,"percentile":0.3969}],"urls":["https://access.redhat.com/errata/RHSA-2026:18160","https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/security/cve/CVE-2026-0968","https://bugzilla.redhat.com/show_bug.cgi?id=2436982","https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0968","description":"A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42497","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-28","epss":0.00458,"percentile":0.39607}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42497"},"relatedVulnerabilities":[{"id":"CVE-2026-42497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-28","epss":0.00458,"percentile":0.39607}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42497","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-28","epss":0.00458,"percentile":0.39607}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42497"},"relatedVulnerabilities":[{"id":"CVE-2026-42497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-28","epss":0.00458,"percentile":0.39607}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42497","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-28","epss":0.00458,"percentile":0.39607}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42497"},"relatedVulnerabilities":[{"id":"CVE-2026-42497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-28","epss":0.00458,"percentile":0.39607}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42497","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-28","epss":0.00458,"percentile":0.39607}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42497"},"relatedVulnerabilities":[{"id":"CVE-2026-42497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-28","epss":0.00458,"percentile":0.39607}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8328","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8328","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8328","cwe":"CWE-918","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-8328","date":"2026-10-28","epss":0.00457,"percentile":0.39578}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8328"},"relatedVulnerabilities":[{"id":"CVE-2026-8328","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8328","cwe":"CWE-918","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-8328","date":"2026-10-28","epss":0.00457,"percentile":0.39578}],"urls":["https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f","https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06","https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0","https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763","https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d","https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9","https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb","https://github.com/python/cpython/issues/87451","https://github.com/python/cpython/pull/149648","https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8328","description":"The ftpcp() function in Lib/ftplib.py was not updated when \nCVE-2021-4189 was fixed. While makepasv() was patched to replace \nserver-supplied PASV host addresses with the actual peer address \n(getpeername()[0]), ftpcp() still calls parse227() directly and passes \nthe raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8328","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8328","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8328","cwe":"CWE-918","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-8328","date":"2026-10-28","epss":0.00457,"percentile":0.39578}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8328"},"relatedVulnerabilities":[{"id":"CVE-2026-8328","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8328","cwe":"CWE-918","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-8328","date":"2026-10-28","epss":0.00457,"percentile":0.39578}],"urls":["https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f","https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06","https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0","https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763","https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d","https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9","https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb","https://github.com/python/cpython/issues/87451","https://github.com/python/cpython/pull/149648","https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8328","description":"The ftpcp() function in Lib/ftplib.py was not updated when \nCVE-2021-4189 was fixed. While makepasv() was patched to replace \nserver-supplied PASV host addresses with the actual peer address \n(getpeername()[0]), ftpcp() still calls parse227() directly and passes \nthe raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8328","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8328","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8328","cwe":"CWE-918","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-8328","date":"2026-10-28","epss":0.00457,"percentile":0.39578}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8328"},"relatedVulnerabilities":[{"id":"CVE-2026-8328","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8328","cwe":"CWE-918","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-8328","date":"2026-10-28","epss":0.00457,"percentile":0.39578}],"urls":["https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f","https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06","https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0","https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763","https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d","https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9","https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb","https://github.com/python/cpython/issues/87451","https://github.com/python/cpython/pull/149648","https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8328","description":"The ftpcp() function in Lib/ftplib.py was not updated when \nCVE-2021-4189 was fixed. While makepasv() was patched to replace \nserver-supplied PASV host addresses with the actual peer address \n(getpeername()[0]), ftpcp() still calls parse227() directly and passes \nthe raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8328","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8328","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8328","cwe":"CWE-918","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-8328","date":"2026-10-28","epss":0.00457,"percentile":0.39578}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8328"},"relatedVulnerabilities":[{"id":"CVE-2026-8328","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8328","cwe":"CWE-918","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-8328","date":"2026-10-28","epss":0.00457,"percentile":0.39578}],"urls":["https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f","https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06","https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0","https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763","https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d","https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9","https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb","https://github.com/python/cpython/issues/87451","https://github.com/python/cpython/pull/149648","https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8328","description":"The ftpcp() function in Lib/ftplib.py was not updated when \nCVE-2021-4189 was fixed. While makepasv() was patched to replace \nserver-supplied PASV host addresses with the actual peer address \n(getpeername()[0]), ftpcp() still calls parse227() directly and passes \nthe raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-4141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-4141","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-4141","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-4141","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-4141","date":"2026-10-28","epss":0.0045,"percentile":0.39008}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-4141"},"relatedVulnerabilities":[{"id":"CVE-2022-4141","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4141","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-4141","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-4141","date":"2026-10-28","epss":0.0045,"percentile":0.39008}],"urls":["https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5","https://huntr.dev/bounties/20ece512-c600-45ac-8a84-d0931e05541f","https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AZ3JMSUCR6Y7626RDWQ2HNSUFIQOJ33G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6ZNKVN4GICORTVFKVCM4MSOXCYWNHUC/","https://security.gentoo.org/glsa/202305-16","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4141","description":"Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-4141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-4141","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-4141","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-4141","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-4141","date":"2026-10-28","epss":0.0045,"percentile":0.39008}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-4141"},"relatedVulnerabilities":[{"id":"CVE-2022-4141","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4141","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-4141","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-4141","date":"2026-10-28","epss":0.0045,"percentile":0.39008}],"urls":["https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5","https://huntr.dev/bounties/20ece512-c600-45ac-8a84-d0931e05541f","https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AZ3JMSUCR6Y7626RDWQ2HNSUFIQOJ33G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6ZNKVN4GICORTVFKVCM4MSOXCYWNHUC/","https://security.gentoo.org/glsa/202305-16","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4141","description":"Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-4141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-4141","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-4141","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-4141","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-4141","date":"2026-10-28","epss":0.0045,"percentile":0.39008}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-4141"},"relatedVulnerabilities":[{"id":"CVE-2022-4141","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4141","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-4141","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-4141","date":"2026-10-28","epss":0.0045,"percentile":0.39008}],"urls":["https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5","https://huntr.dev/bounties/20ece512-c600-45ac-8a84-d0931e05541f","https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AZ3JMSUCR6Y7626RDWQ2HNSUFIQOJ33G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6ZNKVN4GICORTVFKVCM4MSOXCYWNHUC/","https://security.gentoo.org/glsa/202305-16","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4141","description":"Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10735","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2020-10735","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-28","epss":0.04486,"percentile":0.91442}],"risk":0.22429999999999997,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-10735"},"relatedVulnerabilities":[{"id":"CVE-2020-10735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-28","epss":0.04486,"percentile":0.91442}],"urls":["http://www.openwall.com/lists/oss-security/2022/09/21/1","http://www.openwall.com/lists/oss-security/2022/09/21/4","https://access.redhat.com/security/cve/CVE-2020-10735","https://bugzilla.redhat.com/show_bug.cgi?id=1834423","https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","https://github.com/python/cpython/issues/95778","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-806742.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10735","description":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10735","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2020-10735","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-28","epss":0.04486,"percentile":0.91442}],"risk":0.22429999999999997,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-10735"},"relatedVulnerabilities":[{"id":"CVE-2020-10735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-28","epss":0.04486,"percentile":0.91442}],"urls":["http://www.openwall.com/lists/oss-security/2022/09/21/1","http://www.openwall.com/lists/oss-security/2022/09/21/4","https://access.redhat.com/security/cve/CVE-2020-10735","https://bugzilla.redhat.com/show_bug.cgi?id=1834423","https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","https://github.com/python/cpython/issues/95778","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-806742.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10735","description":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-10735","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2020-10735","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-28","epss":0.04486,"percentile":0.91442}],"risk":0.22429999999999997,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-10735"},"relatedVulnerabilities":[{"id":"CVE-2020-10735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-28","epss":0.04486,"percentile":0.91442}],"urls":["http://www.openwall.com/lists/oss-security/2022/09/21/1","http://www.openwall.com/lists/oss-security/2022/09/21/4","https://access.redhat.com/security/cve/CVE-2020-10735","https://bugzilla.redhat.com/show_bug.cgi?id=1834423","https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","https://github.com/python/cpython/issues/95778","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-806742.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10735","description":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10735","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2020-10735","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-28","epss":0.04486,"percentile":0.91442}],"risk":0.22429999999999997,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-10735"},"relatedVulnerabilities":[{"id":"CVE-2020-10735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-28","epss":0.04486,"percentile":0.91442}],"urls":["http://www.openwall.com/lists/oss-security/2022/09/21/1","http://www.openwall.com/lists/oss-security/2022/09/21/4","https://access.redhat.com/security/cve/CVE-2020-10735","https://bugzilla.redhat.com/show_bug.cgi?id=1834423","https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","https://github.com/python/cpython/issues/95778","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-806742.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10735","description":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"d466610980c64a4f","cpes":["cpe:2.3:a:gcc-10-base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10-base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"gcc-10-base","purl":"pkg:deb/ubuntu/gcc-10-base@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/gcc-10-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-28","epss":0.00444,"percentile":0.38507}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95619"},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-28","epss":0.00444,"percentile":0.38507}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"ab4c954aa38d7cce","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-28","epss":0.00444,"percentile":0.38507}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95619"},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-28","epss":0.00444,"percentile":0.38507}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"4b8e34f972831b96","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-28","epss":0.00444,"percentile":0.38507}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95619"},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-28","epss":0.00444,"percentile":0.38507}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-28","epss":0.00439,"percentile":0.38074}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-28","epss":0.00439,"percentile":0.38074}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-28","epss":0.00439,"percentile":0.38074}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-28","epss":0.00439,"percentile":0.38074}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-28","epss":0.00439,"percentile":0.38074}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-28","epss":0.00439,"percentile":0.38074}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-28","epss":0.00439,"percentile":0.38074}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-28","epss":0.00439,"percentile":0.38074}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"8b624c34f5cb5924","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A8.1.2269-1ubuntu5.32?arch=all&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postinst"},{"path":"/var/lib/dpkg/info/vim-common.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.postrm"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.preinst"},{"path":"/var/lib/dpkg/info/vim-common.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-common.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-34982","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34982","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-34982","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34982","date":"2026-10-28","epss":0.00438,"percentile":0.38001}],"risk":0.219,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34982"},"relatedVulnerabilities":[{"id":"CVE-2026-34982","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34982","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-34982","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34982","date":"2026-10-28","epss":0.00438,"percentile":0.38001}],"urls":["https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615","https://github.com/vim/vim/releases/tag/v9.2.0276","https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9","http://www.openwall.com/lists/oss-security/2026/04/01/1","https://access.redhat.com/errata/RHSA-2026:11389","https://access.redhat.com/errata/RHSA-2026:11509","https://access.redhat.com/errata/RHSA-2026:11510","https://access.redhat.com/errata/RHSA-2026:19073","https://access.redhat.com/errata/RHSA-2026:19224","https://access.redhat.com/errata/RHSA-2026:21275","https://access.redhat.com/errata/RHSA-2026:22634","https://access.redhat.com/errata/RHSA-2026:28049","https://access.redhat.com/errata/RHSA-2026:28050","https://access.redhat.com/errata/RHSA-2026:28133","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30900","https://access.redhat.com/errata/RHSA-2026:33453","https://access.redhat.com/errata/RHSA-2026:34476","https://access.redhat.com/errata/RHSA-2026:34477","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:68711","https://access.redhat.com/security/cve/CVE-2026-34982","https://bugzilla.redhat.com/show_bug.cgi?id=2455400","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34982.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34982","description":"Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue."}]},{"artifact":{"id":"0e4e239cb6088eee","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-tiny/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.postrm"},{"path":"/var/lib/dpkg/info/vim-tiny.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.preinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-34982","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34982","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-34982","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34982","date":"2026-10-28","epss":0.00438,"percentile":0.38001}],"risk":0.219,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34982"},"relatedVulnerabilities":[{"id":"CVE-2026-34982","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34982","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-34982","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34982","date":"2026-10-28","epss":0.00438,"percentile":0.38001}],"urls":["https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615","https://github.com/vim/vim/releases/tag/v9.2.0276","https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9","http://www.openwall.com/lists/oss-security/2026/04/01/1","https://access.redhat.com/errata/RHSA-2026:11389","https://access.redhat.com/errata/RHSA-2026:11509","https://access.redhat.com/errata/RHSA-2026:11510","https://access.redhat.com/errata/RHSA-2026:19073","https://access.redhat.com/errata/RHSA-2026:19224","https://access.redhat.com/errata/RHSA-2026:21275","https://access.redhat.com/errata/RHSA-2026:22634","https://access.redhat.com/errata/RHSA-2026:28049","https://access.redhat.com/errata/RHSA-2026:28050","https://access.redhat.com/errata/RHSA-2026:28133","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30900","https://access.redhat.com/errata/RHSA-2026:33453","https://access.redhat.com/errata/RHSA-2026:34476","https://access.redhat.com/errata/RHSA-2026:34477","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:68711","https://access.redhat.com/security/cve/CVE-2026-34982","https://bugzilla.redhat.com/show_bug.cgi?id=2455400","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34982.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34982","description":"Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue."}]},{"artifact":{"id":"c6ec206b9ce8174e","cpes":["cpe:2.3:a:xxd:xxd:2\\:8.1.2269-1ubuntu5.32:*:*:*:*:*:*:*"],"name":"xxd","purl":"pkg:deb/ubuntu/xxd@2%3A8.1.2269-1ubuntu5.32?arch=amd64&distro=ubuntu-20.04&upstream=vim","type":"deb","version":"2:8.1.2269-1ubuntu5.32","language":"","licenses":["Apache","Apache-2.0","Artistic","Artistic-1","BSD-2-clause","BSD-3-clause","Compaq","EDL-1","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","OPL-1+","SRA","UC","Vim","Vim-Regexp","X11","XPM","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xxd/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/xxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xxd.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/xxd.list"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"vim","version":"2:8.1.2269-1ubuntu5.32"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-34982","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34982","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-34982","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34982","date":"2026-10-28","epss":0.00438,"percentile":0.38001}],"risk":0.219,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34982"},"relatedVulnerabilities":[{"id":"CVE-2026-34982","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34982","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-34982","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34982","date":"2026-10-28","epss":0.00438,"percentile":0.38001}],"urls":["https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615","https://github.com/vim/vim/releases/tag/v9.2.0276","https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9","http://www.openwall.com/lists/oss-security/2026/04/01/1","https://access.redhat.com/errata/RHSA-2026:11389","https://access.redhat.com/errata/RHSA-2026:11509","https://access.redhat.com/errata/RHSA-2026:11510","https://access.redhat.com/errata/RHSA-2026:19073","https://access.redhat.com/errata/RHSA-2026:19224","https://access.redhat.com/errata/RHSA-2026:21275","https://access.redhat.com/errata/RHSA-2026:22634","https://access.redhat.com/errata/RHSA-2026:28049","https://access.redhat.com/errata/RHSA-2026:28050","https://access.redhat.com/errata/RHSA-2026:28133","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30900","https://access.redhat.com/errata/RHSA-2026:33453","https://access.redhat.com/errata/RHSA-2026:34476","https://access.redhat.com/errata/RHSA-2026:34477","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:68711","https://access.redhat.com/security/cve/CVE-2026-34982","https://bugzilla.redhat.com/show_bug.cgi?id=2455400","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34982.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34982","description":"Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-28","epss":0.00431,"percentile":0.37287}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15366"},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-28","epss":0.00431,"percentile":0.37287}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-28","epss":0.00431,"percentile":0.37287}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15366"},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-28","epss":0.00431,"percentile":0.37287}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-28","epss":0.00431,"percentile":0.37287}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15366"},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-28","epss":0.00431,"percentile":0.37287}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-28","epss":0.00431,"percentile":0.37287}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15366"},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-10-28","epss":0.00431,"percentile":0.37287}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"bf291b3ff1f0a486","cpes":["cpe:2.3:a:git:git:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A2.25.1-1ubuntu3.14?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1:2.25.1-1ubuntu3.14","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-48386","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git","version":"1:2.25.1-1ubuntu3.14"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-48386","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-48386","cwe":"CWE-120","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-48386","date":"2026-10-28","epss":0.00431,"percentile":0.37283}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-48386"},"relatedVulnerabilities":[{"id":"CVE-2025-48386","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.3,"impactScore":4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48386","cwe":"CWE-120","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-48386","date":"2026-10-28","epss":0.00431,"percentile":0.37283}],"urls":["https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr","http://www.openwall.com/lists/oss-security/2025/07/08/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48386","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."}]},{"artifact":{"id":"160f2ca74a1211ed","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.25.1-1ubuntu3.14:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A2.25.1-1ubuntu3.14?arch=all&distro=ubuntu-20.04&upstream=git","type":"deb","version":"1:2.25.1-1ubuntu3.14","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-48386","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"git","version":"1:2.25.1-1ubuntu3.14"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-48386","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-48386","cwe":"CWE-120","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-48386","date":"2026-10-28","epss":0.00431,"percentile":0.37283}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-48386"},"relatedVulnerabilities":[{"id":"CVE-2025-48386","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.3,"impactScore":4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48386","cwe":"CWE-120","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-48386","date":"2026-10-28","epss":0.00431,"percentile":0.37283}],"urls":["https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr","http://www.openwall.com/lists/oss-security/2025/07/08/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48386","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."}]},{"artifact":{"id":"c98e6dac9c14f84d","cpes":["cpe:2.3:a:tar:tar:1.30\\+dfsg-7ubuntu0.20.04.4:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/ubuntu/tar@1.30%2Bdfsg-7ubuntu0.20.04.4?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.30+dfsg-7ubuntu0.20.04.4","language":"","licenses":["sha256:9292780f2dfd11900e92ea67c7a316cf9df740b955956f87ec099a5b4f3d9136"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5704","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"tar","version":"1.30+dfsg-7ubuntu0.20.04.4"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5704","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-10-28","epss":0.0043,"percentile":0.37099}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5704"},"relatedVulnerabilities":[{"id":"CVE-2026-5704","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-10-28","epss":0.0043,"percentile":0.37099}],"urls":["https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:66514","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-5704","https://bugzilla.redhat.com/show_bug.cgi?id=2455360","http://www.openwall.com/lists/oss-security/2026/04/11/10","http://www.openwall.com/lists/oss-security/2026/04/11/11","http://www.openwall.com/lists/oss-security/2026/04/12/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."}]},{"artifact":{"id":"ea10df21877a4e59","cpes":["cpe:2.3:a:libpython3.8-minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_minimal:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-minimal","purl":"pkg:deb/ubuntu/libpython3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9669","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9669","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9669","cwe":"CWE-121","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-9669","date":"2026-10-28","epss":0.00428,"percentile":0.36906}],"risk":0.214,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9669"},"relatedVulnerabilities":[{"id":"CVE-2026-9669","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9669","cwe":"CWE-121","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-9669","date":"2026-10-28","epss":0.00428,"percentile":0.36906}],"urls":["https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6","https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636","https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e","https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f","https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79","https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2","https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d","https://github.com/python/cpython/issues/150599","https://github.com/python/cpython/pull/150600","https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/","http://www.openwall.com/lists/oss-security/2026/06/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9669","description":"bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data."}]},{"artifact":{"id":"a095942f0fccb085","cpes":["cpe:2.3:a:libpython3.8-stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8-stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8_stdlib:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8-stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.8:libpython3.8_stdlib:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"libpython3.8-stdlib","purl":"pkg:deb/ubuntu/libpython3.8-stdlib@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libpython3.8-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libpython3.8-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9669","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9669","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9669","cwe":"CWE-121","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-9669","date":"2026-10-28","epss":0.00428,"percentile":0.36906}],"risk":0.214,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9669"},"relatedVulnerabilities":[{"id":"CVE-2026-9669","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9669","cwe":"CWE-121","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-9669","date":"2026-10-28","epss":0.00428,"percentile":0.36906}],"urls":["https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6","https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636","https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e","https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f","https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79","https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2","https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d","https://github.com/python/cpython/issues/150599","https://github.com/python/cpython/pull/150600","https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/","http://www.openwall.com/lists/oss-security/2026/06/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9669","description":"bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data."}]},{"artifact":{"id":"53ac7387441f0e39","cpes":["cpe:2.3:a:python3.8:python3.8:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8","purl":"pkg:deb/ubuntu/python3.8@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.list"},{"path":"/var/lib/dpkg/info/python3.8.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.postinst"},{"path":"/var/lib/dpkg/info/python3.8.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9669","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9669","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9669","cwe":"CWE-121","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-9669","date":"2026-10-28","epss":0.00428,"percentile":0.36906}],"risk":0.214,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9669"},"relatedVulnerabilities":[{"id":"CVE-2026-9669","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9669","cwe":"CWE-121","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-9669","date":"2026-10-28","epss":0.00428,"percentile":0.36906}],"urls":["https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6","https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636","https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e","https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f","https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79","https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2","https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d","https://github.com/python/cpython/issues/150599","https://github.com/python/cpython/pull/150600","https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/","http://www.openwall.com/lists/oss-security/2026/06/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9669","description":"bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data."}]},{"artifact":{"id":"4be9754fb0305436","cpes":["cpe:2.3:a:python3.8-minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8-minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8_minimal:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8-minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*","cpe:2.3:a:python3.8:python3.8_minimal:3.8.10-0ubuntu1\\~20.04.18:*:*:*:*:*:*:*"],"name":"python3.8-minimal","purl":"pkg:deb/ubuntu/python3.8-minimal@3.8.10-0ubuntu1~20.04.18?arch=amd64&distro=ubuntu-20.04&upstream=python3.8","type":"deb","version":"3.8.10-0ubuntu1~20.04.18","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.8-minimal/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/python3.8-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.8-minimal.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.list"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.8-minimal.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.8-minimal.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/python3.8-minimal.prerm"}],"upstreams":[{"name":"python3.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9669","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"python3.8","version":"3.8.10-0ubuntu1~20.04.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9669","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9669","cwe":"CWE-121","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-9669","date":"2026-10-28","epss":0.00428,"percentile":0.36906}],"risk":0.214,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9669"},"relatedVulnerabilities":[{"id":"CVE-2026-9669","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9669","cwe":"CWE-121","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-9669","date":"2026-10-28","epss":0.00428,"percentile":0.36906}],"urls":["https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6","https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636","https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e","https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f","https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79","https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2","https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d","https://github.com/python/cpython/issues/150599","https://github.com/python/cpython/pull/150600","https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/","http://www.openwall.com/lists/oss-security/2026/06/08/17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9669","description":"bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data."}]},{"artifact":{"id":"68b2eaee91f56791","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.34-7ubuntu0.1?arch=amd64&distro=ubuntu-20.04&upstream=pcre2","type":"deb","version":"10.34-7ubuntu0.1","language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pcre2","version":"10.34-7ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-28","epss":0.00425,"percentile":0.36622}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-28","epss":0.00425,"percentile":0.36622}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9076","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9076","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-10-28","epss":0.00707,"percentile":0.53283}],"risk":0.2121,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9076"},"relatedVulnerabilities":[{"id":"CVE-2026-9076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-10-28","epss":0.00707,"percentile":0.53283}],"urls":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9076","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9076","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-10-28","epss":0.00707,"percentile":0.53283}],"risk":0.2121,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9076"},"relatedVulnerabilities":[{"id":"CVE-2026-9076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-10-28","epss":0.00707,"percentile":0.53283}],"urls":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue."}]},{"artifact":{"id":"bfe6694a44340acd","cpes":["cpe:2.3:a:libssh-4:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh-4:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh_4:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_4:0.9.3-2ubuntu2.5:*:*:*:*:*:*:*"],"name":"libssh-4","purl":"pkg:deb/ubuntu/libssh-4@0.9.3-2ubuntu2.5?arch=amd64&distro=ubuntu-20.04&upstream=libssh","type":"deb","version":"0.9.3-2ubuntu2.5","language":"","licenses":["BSD-2-clause","BSD-3-clause","LGPL-2.1","LGPL-2.1+~OpenSSL","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh-4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssh-4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssh-4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libssh","version":"0.9.3-2ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0964","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0964","date":"2026-10-28","epss":0.00424,"percentile":0.36599}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0964"},"relatedVulnerabilities":[{"id":"CVE-2026-0964","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0964","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0964","date":"2026-10-28","epss":0.00424,"percentile":0.36599}],"urls":["https://access.redhat.com/errata/RHSA-2026:18160","https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/security/cve/CVE-2026-0964","https://bugzilla.redhat.com/show_bug.cgi?id=2436979","https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0964","description":"A malicious SCP server can send unexpected paths that could make the\nclient application override local files outside of working directory.\nThis could be misused to create malicious executable or configuration\nfiles and make the user execute them under specific consequences.\n\nThis is the same issue as in OpenSSH, tracked as CVE-2019-6111."}]},{"artifact":{"id":"1ec2a53545b654f8","cpes":["cpe:2.3:a:krb5-locales:krb5-locales:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:krb5-locales:krb5_locales:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:krb5_locales:krb5-locales:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:krb5_locales:krb5_locales:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-locales:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_locales:1.17-6ubuntu4.11:*:*:*:*:*:*:*"],"name":"krb5-locales","purl":"pkg:deb/ubuntu/krb5-locales@1.17-6ubuntu4.11?arch=all&distro=ubuntu-20.04&upstream=krb5","type":"deb","version":"1.17-6ubuntu4.11","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/krb5-locales/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/krb5-locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-locales.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/krb5-locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-locales.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/krb5-locales.list"}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"krb5","version":"1.17-6ubuntu4.11"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-28","epss":0.00424,"percentile":0.36598}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-28","epss":0.00424,"percentile":0.36598}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"5f38b4e39807ff82","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.17-6ubuntu4.11:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.17-6ubuntu4.11?arch=amd64&distro=ubuntu-20.04&upstream=krb5","type":"deb","version":"1.17-6ubuntu4.11","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"krb5","version":"1.17-6ubuntu4.11"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-28","epss":0.00424,"percentile":0.36598}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-28","epss":0.00424,"percentile":0.36598}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"00ad3c4c00076eb8","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.17-6ubuntu4.11:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.17-6ubuntu4.11?arch=amd64&distro=ubuntu-20.04&upstream=krb5","type":"deb","version":"1.17-6ubuntu4.11","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"krb5","version":"1.17-6ubuntu4.11"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-28","epss":0.00424,"percentile":0.36598}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-28","epss":0.00424,"percentile":0.36598}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"2bd40669966113dc","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.17-6ubuntu4.11:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.17-6ubuntu4.11:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.17-6ubuntu4.11?arch=amd64&distro=ubuntu-20.04&upstream=krb5","type":"deb","version":"1.17-6ubuntu4.11","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"krb5","version":"1.17-6ubuntu4.11"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-28","epss":0.00424,"percentile":0.36598}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-28","epss":0.00424,"percentile":0.36598}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"8d245d32416932bf","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.17-6ubuntu4.11:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.17-6ubuntu4.11?arch=amd64&distro=ubuntu-20.04&upstream=krb5","type":"deb","version":"1.17-6ubuntu4.11","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"krb5","version":"1.17-6ubuntu4.11"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-28","epss":0.00424,"percentile":0.36598}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-28","epss":0.00424,"percentile":0.36598}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42013","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42013","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42013","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42013","date":"2026-10-28","epss":0.00423,"percentile":0.36455}],"risk":0.21150000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42013"},"relatedVulnerabilities":[{"id":"CVE-2026-42013","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42013","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42013","date":"2026-10-28","epss":0.00423,"percentile":0.36455}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:43575","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42013","https://bugzilla.redhat.com/show_bug.cgi?id=2467448","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42013","description":"A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-28","epss":0.00418,"percentile":0.36032}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19487"},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-28","epss":0.00418,"percentile":0.36032}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-28","epss":0.00418,"percentile":0.36032}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19487"},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-28","epss":0.00418,"percentile":0.36032}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-28","epss":0.00418,"percentile":0.36032}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19487"},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-28","epss":0.00418,"percentile":0.36032}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-28","epss":0.00418,"percentile":0.36032}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19487"},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-28","epss":0.00418,"percentile":0.36032}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"34f967921c09dcd9","cpes":["cpe:2.3:a:curl:curl:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-28","epss":0.00414,"percentile":0.35523}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5545"},"relatedVulnerabilities":[{"id":"CVE-2026-5545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-28","epss":0.00414,"percentile":0.35523}],"urls":["https://curl.se/docs/CVE-2026-5545.html","https://curl.se/docs/CVE-2026-5545.json","https://hackerone.com/reports/3642555"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1..."}]},{"artifact":{"id":"bf88a5f755934444","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-28","epss":0.00414,"percentile":0.35523}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5545"},"relatedVulnerabilities":[{"id":"CVE-2026-5545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-28","epss":0.00414,"percentile":0.35523}],"urls":["https://curl.se/docs/CVE-2026-5545.html","https://curl.se/docs/CVE-2026-5545.json","https://hackerone.com/reports/3642555"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1..."}]},{"artifact":{"id":"25fcf12ace6abd0f","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-28","epss":0.00414,"percentile":0.35523}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5545"},"relatedVulnerabilities":[{"id":"CVE-2026-5545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-28","epss":0.00414,"percentile":0.35523}],"urls":["https://curl.se/docs/CVE-2026-5545.html","https://curl.se/docs/CVE-2026-5545.json","https://hackerone.com/reports/3642555"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1..."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4014","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4014","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58183","date":"2026-10-28","epss":0.00443,"percentile":0.38392}],"risk":0.20599499999999996,"urls":["https://go.dev/issue/75677","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709861","description":"tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations."},"relatedVulnerabilities":[{"id":"CVE-2025-58183","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58183","date":"2026-10-28","epss":0.00443,"percentile":0.38392}],"urls":["https://go.dev/cl/709861","https://go.dev/issue/75677","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4014","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58183","description":"tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4980","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4980","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39826","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39826","date":"2026-10-28","epss":0.00371,"percentile":0.30945}],"risk":0.20590499999999998,"urls":["https://go.dev/cl/771180","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78981","description":"If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block."},"relatedVulnerabilities":[{"id":"CVE-2026-39826","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39826","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39826","date":"2026-10-28","epss":0.00371,"percentile":0.30945}],"urls":["https://go.dev/cl/771180","https://go.dev/issue/78981","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4980"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39826","description":"If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block."}]},{"artifact":{"id":"34f967921c09dcd9","cpes":["cpe:2.3:a:curl:curl:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-14524","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-14524","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-28","epss":0.0068,"percentile":0.52282}],"risk":0.20399999999999996,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14524"},"relatedVulnerabilities":[{"id":"CVE-2025-14524","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-28","epss":0.0068,"percentile":0.52282}],"urls":["https://curl.se/docs/CVE-2025-14524.html","https://curl.se/docs/CVE-2025-14524.json","https://hackerone.com/reports/3459417","http://www.openwall.com/lists/oss-security/2026/01/07/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."}]},{"artifact":{"id":"bf88a5f755934444","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14524","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-14524","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-28","epss":0.0068,"percentile":0.52282}],"risk":0.20399999999999996,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14524"},"relatedVulnerabilities":[{"id":"CVE-2025-14524","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-28","epss":0.0068,"percentile":0.52282}],"urls":["https://curl.se/docs/CVE-2025-14524.html","https://curl.se/docs/CVE-2025-14524.json","https://hackerone.com/reports/3459417","http://www.openwall.com/lists/oss-security/2026/01/07/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."}]},{"artifact":{"id":"25fcf12ace6abd0f","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14524","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-14524","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-28","epss":0.0068,"percentile":0.52282}],"risk":0.20399999999999996,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14524"},"relatedVulnerabilities":[{"id":"CVE-2025-14524","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-28","epss":0.0068,"percentile":0.52282}],"urls":["https://curl.se/docs/CVE-2025-14524.html","https://curl.se/docs/CVE-2025-14524.json","https://hackerone.com/reports/3459417","http://www.openwall.com/lists/oss-security/2026/01/07/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."}]},{"artifact":{"id":"198ee162877e76c2","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.9-1ubuntu0.8:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.2.9-1ubuntu0.8?arch=amd64&distro=ubuntu-20.04&upstream=expat","type":"deb","version":"2.2.9-1ubuntu0.8","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"expat","version":"2.2.9-1ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-93990","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-28","epss":0.00403,"percentile":0.34468}],"risk":0.20149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93990"},"relatedVulnerabilities":[{"id":"CVE-2026-93990","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-28","epss":0.00403,"percentile":0.34468}],"urls":["https://blog.hartwork.org/posts/expat-2-8-5-released/","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a","https://github.com/libexpat/libexpat/pull/1282","https://github.com/libexpat/libexpat/releases/tag/R_2_8_5","https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28387","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-10-28","epss":0.00671,"percentile":0.51887}],"risk":0.2013,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28387"},"relatedVulnerabilities":[{"id":"CVE-2026-28387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-10-28","epss":0.00671,"percentile":0.51887}],"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28387","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-10-28","epss":0.00671,"percentile":0.51887}],"risk":0.2013,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28387"},"relatedVulnerabilities":[{"id":"CVE-2026-28387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-10-28","epss":0.00671,"percentile":0.51887}],"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4976","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4976","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39825","date":"2026-10-28","epss":0.0039,"percentile":0.3305}],"risk":0.20084999999999997,"urls":["https://go.dev/issue/78948","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/770541","description":"ReverseProxy can forward queries containing parameters not visible to Rewrite functions.\n\nWhen used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function.\n\nFor example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function."},"relatedVulnerabilities":[{"id":"CVE-2026-39825","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39825","date":"2026-10-28","epss":0.0039,"percentile":0.3305}],"urls":["https://go.dev/cl/770541","https://go.dev/issue/78948","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4976"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39825","description":"ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function."}]},{"artifact":{"id":"bebf031c5eb7c7b1","cpes":["cpe:2.3:a:golang:go:1.20.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.20.7","type":"go-module","version":"go1.20.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.20.7"},"locations":[{"path":"/usr/local/bin/fixuid","layerID":"sha256:45cd74a593a97b26627b01fe17f4b8c848f3a5c9c1312619391f929fc58df621","accessPath":"/usr/local/bin/fixuid","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-3503","versionConstraint":"<1.23.7||>=1.24.0-0,<1.24.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.20.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-3503","fix":{"state":"fixed","versions":["1.23.7","1.24.1"],"available":[{"date":"2025-03-04","kind":"release","version":"1.23.7"},{"date":"2025-03-04","kind":"release","version":"1.24.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22870","cwe":"CWE-115","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22870","date":"2026-10-28","epss":0.00425,"percentile":0.36642}],"risk":0.19975,"urls":["https://go.dev/issue/71984","https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/654697","description":"Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied."},"relatedVulnerabilities":[{"id":"CVE-2025-22870","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22870","cwe":"CWE-115","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22870","date":"2026-10-28","epss":0.00425,"percentile":0.36642}],"urls":["https://go.dev/cl/654697","https://go.dev/issue/71984","https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ","https://pkg.go.dev/vuln/GO-2025-3503","http://www.openwall.com/lists/oss-security/2025/03/07/2","https://security.netapp.com/advisory/ntap-20250509-0007/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22870","description":"Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied."},{"id":"GHSA-qxp5-gwg8-xv66","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22870","cwe":"CWE-115","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22870","date":"2026-10-28","epss":0.00425,"percentile":0.36642}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-22870","https://go.dev/cl/654697","https://go.dev/issue/71984","https://pkg.go.dev/vuln/GO-2025-3503","http://www.openwall.com/lists/oss-security/2025/03/07/2","https://security.netapp.com/advisory/ntap-20250509-0007","https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ"],"severity":"Medium","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-qxp5-gwg8-xv66","description":"HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net"}]},{"artifact":{"id":"198ee162877e76c2","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.9-1ubuntu0.8:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.2.9-1ubuntu0.8?arch=amd64&distro=ubuntu-20.04&upstream=expat","type":"deb","version":"2.2.9-1ubuntu0.8","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-41080","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"expat","version":"2.2.9-1ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-41080","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-41080","cwe":"CWE-331","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-41080","date":"2026-10-28","epss":0.00398,"percentile":0.33927}],"risk":0.199,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-41080"},"relatedVulnerabilities":[{"id":"CVE-2026-41080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41080","cwe":"CWE-331","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-41080","date":"2026-10-28","epss":0.00398,"percentile":0.33927}],"urls":["https://blog.hartwork.org/posts/expat-2-8-0-released/","https://github.com/libexpat/libexpat/issues/47","https://github.com/libexpat/libexpat/pull/1183","https://www.openwall.com/lists/oss-security/2026/04/26/1","http://www.openwall.com/lists/oss-security/2026/04/26/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41080","description":"libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document."}]},{"artifact":{"id":"34f967921c09dcd9","cpes":["cpe:2.3:a:curl:curl:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8924","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-28","epss":0.00661,"percentile":0.51464}],"risk":0.1983,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8924"},"relatedVulnerabilities":[{"id":"CVE-2026-8924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-28","epss":0.00661,"percentile":0.51464}],"urls":["https://curl.se/docs/CVE-2026-8924.html","https://curl.se/docs/CVE-2026-8924.json","https://hackerone.com/reports/3733905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains."}]},{"artifact":{"id":"bf88a5f755934444","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8924","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-28","epss":0.00661,"percentile":0.51464}],"risk":0.1983,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8924"},"relatedVulnerabilities":[{"id":"CVE-2026-8924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-28","epss":0.00661,"percentile":0.51464}],"urls":["https://curl.se/docs/CVE-2026-8924.html","https://curl.se/docs/CVE-2026-8924.json","https://hackerone.com/reports/3733905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains."}]},{"artifact":{"id":"25fcf12ace6abd0f","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.68.0-1ubuntu2.25:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/ubuntu/libcurl4@7.68.0-1ubuntu2.25?arch=amd64&distro=ubuntu-20.04&upstream=curl","type":"deb","version":"7.68.0-1ubuntu2.25","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6c93520f923a9a8330cf2670345a51333bd0aed890c6b76162e5a6f01b060d42","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:3f02a6ff692ff0f2e91ac76909eeb4834f9c18cca108d23fbbb8047a9f16a71e","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"curl","version":"7.68.0-1ubuntu2.25"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8924","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-28","epss":0.00661,"percentile":0.51464}],"risk":0.1983,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8924"},"relatedVulnerabilities":[{"id":"CVE-2026-8924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-28","epss":0.00661,"percentile":0.51464}],"urls":["https://curl.se/docs/CVE-2026-8924.html","https://curl.se/docs/CVE-2026-8924.json","https://hackerone.com/reports/3733905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains."}]}],"grade":"F","score":"0.00","as_of":"2026-10-30T06:20:40.514Z","grype_db_version":"2026-10-29T06:23:34.000Z"}