{"grype_matches":[{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-12","epss":0.01284,"percentile":0.70529}],"risk":1.00152,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object."},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-12","epss":0.01284,"percentile":0.70529}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-12","epss":0.01284,"percentile":0.70529}],"risk":1.00152,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object."},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-12","epss":0.01284,"percentile":0.70529}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-12","epss":0.01166,"percentile":0.67764}],"risk":0.8744999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process."},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-12","epss":0.01166,"percentile":0.67764}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-12","epss":0.01166,"percentile":0.67764}],"risk":0.8744999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process."},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-12","epss":0.01166,"percentile":0.67764}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-12","epss":0.01045,"percentile":0.64615}],"risk":0.8151,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle."},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-12","epss":0.01045,"percentile":0.64615}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-12","epss":0.01045,"percentile":0.64615}],"risk":0.8151,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle."},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-12","epss":0.01045,"percentile":0.64615}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-12","epss":0.00995,"percentile":0.6314}],"risk":0.7761,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS."},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-12","epss":0.00995,"percentile":0.6314}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-12","epss":0.00995,"percentile":0.6314}],"risk":0.7761,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS."},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-12","epss":0.00995,"percentile":0.6314}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"62a5d35d415a9784","cpes":["cpe:2.3:a:apt:apt:3.3.5:*:*:*:*:*:*:*"],"name":"apt","purl":"pkg:deb/debian/apt@3.3.5?arch=amd64&distro=debian","type":"deb","version":"3.3.5","language":"","licenses":["BSD-3-clause","Expat","GPL-2","GPL-2+","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/apt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.list"},{"path":"/var/lib/dpkg/info/apt.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.postinst"},{"path":"/var/lib/dpkg/info/apt.postrm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.postrm"},{"path":"/var/lib/dpkg/info/apt.preinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.preinst"},{"path":"/var/lib/dpkg/info/apt.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.prerm"},{"path":"/var/lib/dpkg/info/apt.shlibs","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.shlibs"},{"path":"/var/lib/dpkg/info/apt.triggers","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.triggers"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.3.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109518","versionConstraint":"< 3.3.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"apt","version":"3.3.5"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-109518","fix":{"state":"fixed","versions":["3.3.6"],"available":[{"date":"2026-11-05","kind":"first-observed","version":"3.3.6"}]},"cvss":[{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-12","epss":0.00928,"percentile":0.61031}],"risk":0.70528,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-109518","description":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.    The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"},"relatedVulnerabilities":[{"id":"CVE-2026-109518","cvss":[{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-12","epss":0.00928,"percentile":0.61031}],"urls":["https://lists.debian.org/debian-security-announce/2026/msg00526.html","https://ubuntu.com/security/notices/USN-8996-1","http://www.openwall.com/lists/oss-security/2026/11/04/12","https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109518","description":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}]},{"artifact":{"id":"702bf01c1f6f1038","cpes":["cpe:2.3:a:libapt-pkg7.0:libapt-pkg7.0:3.3.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt-pkg7.0:libapt_pkg7.0:3.3.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg7.0:libapt-pkg7.0:3.3.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg7.0:libapt_pkg7.0:3.3.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-pkg7.0:3.3.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_pkg7.0:3.3.5:*:*:*:*:*:*:*"],"name":"libapt-pkg7.0","purl":"pkg:deb/debian/libapt-pkg7.0@3.3.5?arch=amd64&distro=debian&upstream=apt","type":"deb","version":"3.3.5","language":"","licenses":["BSD-3-clause","Expat","GPL-2","GPL-2+","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-pkg7.0/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libapt-pkg7.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-pkg7.0:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libapt-pkg7.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.3.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109518","versionConstraint":"< 3.3.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"apt","version":"3.3.5"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-109518","fix":{"state":"fixed","versions":["3.3.6"],"available":[{"date":"2026-11-05","kind":"first-observed","version":"3.3.6"}]},"cvss":[{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-12","epss":0.00928,"percentile":0.61031}],"risk":0.70528,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-109518","description":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.    The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"},"relatedVulnerabilities":[{"id":"CVE-2026-109518","cvss":[{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-12","epss":0.00928,"percentile":0.61031}],"urls":["https://lists.debian.org/debian-security-announce/2026/msg00526.html","https://ubuntu.com/security/notices/USN-8996-1","http://www.openwall.com/lists/oss-security/2026/11/04/12","https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109518","description":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc2-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0~rc2-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0~rc2-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc2-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-12","epss":0.00776,"percentile":0.56282}],"risk":0.7022800000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket—generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of `--location-trusted`."},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-12","epss":0.00776,"percentile":0.56282}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc2-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0~rc2-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0~rc2-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc2-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-12","epss":0.00776,"percentile":0.56282}],"risk":0.7022800000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket—generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of `--location-trusted`."},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-12","epss":0.00776,"percentile":0.56282}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.68625,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.68625,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.68625,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.68625,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.6749999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.6749999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.6749999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.6749999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-12","epss":0.00731,"percentile":0.54794}],"risk":0.661555,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there."},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-12","epss":0.00731,"percentile":0.54794}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-12","epss":0.00731,"percentile":0.54794}],"risk":0.661555,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there."},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-12","epss":0.00731,"percentile":0.54794}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"risk":0.64584,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains."},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"risk":0.64584,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss."},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"risk":0.64584,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file."},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"risk":0.64584,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains."},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"risk":0.64584,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss."},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"risk":0.64584,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file."},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-12","epss":0.00699,"percentile":0.53631}],"risk":0.632595,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer."},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-12","epss":0.00699,"percentile":0.53631}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-12","epss":0.00699,"percentile":0.53631}],"risk":0.632595,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer."},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-12","epss":0.00699,"percentile":0.53631}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`."},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused."},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`."},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused."},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-12","epss":0.00766,"percentile":0.55977}],"risk":0.59748,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect."},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-12","epss":0.00766,"percentile":0.55977}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-12","epss":0.00766,"percentile":0.55977}],"risk":0.59748,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect."},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-12","epss":0.00766,"percentile":0.55977}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.58425,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.58425,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.58425,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.58425,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-12","epss":0.00721,"percentile":0.54439}],"risk":0.56238,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle."},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-12","epss":0.00721,"percentile":0.54439}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-12","epss":0.00721,"percentile":0.54439}],"risk":0.56238,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle."},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-12","epss":0.00721,"percentile":0.54439}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-12","epss":0.00705,"percentile":0.53842}],"risk":0.5499,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send."},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-12","epss":0.00705,"percentile":0.53842}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-12","epss":0.00705,"percentile":0.53842}],"risk":0.5499,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send."},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-12","epss":0.00705,"percentile":0.53842}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.5482499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.5482499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.5482499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.5482499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-12","epss":0.00667,"percentile":0.52376}],"risk":0.52026,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-12","epss":0.00667,"percentile":0.52376}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-12","epss":0.00667,"percentile":0.52376}],"risk":0.52026,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-12","epss":0.00667,"percentile":0.52376}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"6c639d2a48be13c9","cpes":["cpe:2.3:a:perl-base:perl-base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.42.3-1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.42.3-1?arch=amd64&distro=debian&upstream=perl","type":"deb","version":"5.42.3-1","language":"","licenses":["Artistic","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","DRAND48","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"perl","version":"5.42.3-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"risk":0.47250000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.  Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.  Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-12","epss":0.00604,"percentile":0.49432}],"risk":0.44998,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-12","epss":0.00604,"percentile":0.49432}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-12","epss":0.00604,"percentile":0.49432}],"risk":0.44998,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-12","epss":0.00604,"percentile":0.49432}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-12","epss":0.00589,"percentile":0.48673}],"risk":0.44175000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint."},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-12","epss":0.00589,"percentile":0.48673}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-12","epss":0.00589,"percentile":0.48673}],"risk":0.44175000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint."},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-12","epss":0.00589,"percentile":0.48673}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"3339159594e483f3","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.3.dfsg%2Breally1.3.2-3?arch=amd64&distro=debian&upstream=zlib","type":"deb","version":"1:1.3.dfsg+really1.3.2-3","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.dfsg+really1.3.2-4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76844","versionConstraint":"< 1:1.3.dfsg+really1.3.2-4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"zlib","version":"1:1.3.dfsg+really1.3.2-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-76844","fix":{"state":"fixed","versions":["1:1.3.dfsg+really1.3.2-4"],"available":[{"date":"2026-11-06","kind":"first-observed","version":"1:1.3.dfsg+really1.3.2-4"}]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76844","cwe":"CWE-787","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76844","date":"2026-11-12","epss":0.00592,"percentile":0.488}],"risk":0.44104,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76844","description":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."},"relatedVulnerabilities":[{"id":"CVE-2026-76844","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76844","cwe":"CWE-787","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76844","date":"2026-11-12","epss":0.00592,"percentile":0.488}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76844","description":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."}]},{"artifact":{"id":"b56d73e24bc7ed32","cpes":["cpe:2.3:a:zlib1g-dev:zlib1g-dev:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g-dev:zlib1g_dev:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g-dev:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g_dev:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g-dev:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g_dev:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*"],"name":"zlib1g-dev","purl":"pkg:deb/debian/zlib1g-dev@1%3A1.3.dfsg%2Breally1.3.2-3?arch=amd64&distro=debian&upstream=zlib","type":"deb","version":"1:1.3.dfsg+really1.3.2-3","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/zlib1g-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.dfsg+really1.3.2-4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76844","versionConstraint":"< 1:1.3.dfsg+really1.3.2-4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"zlib","version":"1:1.3.dfsg+really1.3.2-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-76844","fix":{"state":"fixed","versions":["1:1.3.dfsg+really1.3.2-4"],"available":[{"date":"2026-11-06","kind":"first-observed","version":"1:1.3.dfsg+really1.3.2-4"}]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76844","cwe":"CWE-787","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76844","date":"2026-11-12","epss":0.00592,"percentile":0.488}],"risk":0.44104,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76844","description":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."},"relatedVulnerabilities":[{"id":"CVE-2026-76844","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76844","cwe":"CWE-787","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76844","date":"2026-11-12","epss":0.00592,"percentile":0.488}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76844","description":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.42665,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.42665,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.42665,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.42665,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc2-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0~rc2-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0~rc2-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc2-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-12","epss":0.00556,"percentile":0.46868}],"risk":0.41700000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did."},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-12","epss":0.00556,"percentile":0.46868}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc2-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0~rc2-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0~rc2-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc2-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-12","epss":0.00556,"percentile":0.46868}],"risk":0.41700000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did."},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-12","epss":0.00556,"percentile":0.46868}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.40019999999999994,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.40019999999999994,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.40019999999999994,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.40019999999999994,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"3339159594e483f3","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.3.dfsg%2Breally1.3.2-3?arch=amd64&distro=debian&upstream=zlib","type":"deb","version":"1:1.3.dfsg+really1.3.2-3","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.dfsg+really1.3.2-4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1:1.3.dfsg+really1.3.2-4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"zlib","version":"1:1.3.dfsg+really1.3.2-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"fixed","versions":["1:1.3.dfsg+really1.3.2-4"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"1:1.3.dfsg+really1.3.2-4"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-11-12","epss":0.00469,"percentile":0.41055}],"risk":0.37051,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-11-12","epss":0.00469,"percentile":0.41055}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"b56d73e24bc7ed32","cpes":["cpe:2.3:a:zlib1g-dev:zlib1g-dev:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g-dev:zlib1g_dev:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g-dev:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g_dev:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g-dev:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g_dev:1\\:1.3.dfsg\\+really1.3.2-3:*:*:*:*:*:*:*"],"name":"zlib1g-dev","purl":"pkg:deb/debian/zlib1g-dev@1%3A1.3.dfsg%2Breally1.3.2-3?arch=amd64&distro=debian&upstream=zlib","type":"deb","version":"1:1.3.dfsg+really1.3.2-3","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/zlib1g-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.dfsg+really1.3.2-4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1:1.3.dfsg+really1.3.2-4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"zlib","version":"1:1.3.dfsg+really1.3.2-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"fixed","versions":["1:1.3.dfsg+really1.3.2-4"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"1:1.3.dfsg+really1.3.2-4"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-11-12","epss":0.00469,"percentile":0.41055}],"risk":0.37051,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-11-12","epss":0.00469,"percentile":0.41055}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"1b825b249b1ebaeb","cpes":["cpe:2.3:a:gcc-16-base:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16-base:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16_base:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16_base:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*"],"name":"gcc-16-base","purl":"pkg:deb/debian/gcc-16-base@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/gcc-16-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-16-base:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/gcc-16-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"fix":{"suggestedVersion":"16.2.0-4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"< 16.2.0-4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"fixed","versions":["16.2.0-4"],"available":[{"date":"2026-10-25","kind":"first-observed","version":"16.2.0-4"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"risk":0.36632,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"8520c2979cc4e2cf","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"fix":{"suggestedVersion":"16.2.0-4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"< 16.2.0-4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"fixed","versions":["16.2.0-4"],"available":[{"date":"2026-10-25","kind":"first-observed","version":"16.2.0-4"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"risk":0.36632,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"d4533c669aff8d23","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:16.2.0-3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"fix":{"suggestedVersion":"16.2.0-4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"< 16.2.0-4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"fixed","versions":["16.2.0-4"],"available":[{"date":"2026-10-25","kind":"first-observed","version":"16.2.0-4"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"risk":0.36632,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"1b825b249b1ebaeb","cpes":["cpe:2.3:a:gcc-16-base:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16-base:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16_base:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16_base:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*"],"name":"gcc-16-base","purl":"pkg:deb/debian/gcc-16-base@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/gcc-16-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-16-base:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/gcc-16-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"risk":0.36515000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"8520c2979cc4e2cf","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"risk":0.36515000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"d4533c669aff8d23","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:16.2.0-3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"risk":0.36515000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"ee1fb93e1790b636","cpes":["cpe:2.3:a:libldap2:libldap2:2.6.14\\+dfsg-2:*:*:*:*:*:*:*"],"name":"libldap2","purl":"pkg:deb/debian/libldap2@2.6.14%2Bdfsg-2?arch=amd64&distro=debian&upstream=openldap","type":"deb","version":"2.6.14+dfsg-2","language":"","licenses":["BSD-3-clause","BSD-3-clause-California","BSD-3-clause-variant","BSD-4-clause-California","Beerware","Expat","Expat-ISC","Expat-UNM","F5","FSF-unlimited","GPL-2","GPL-2+","GPL-3","GPL-3+","JCG","MIT-XC","NeoSoft-permissive","OpenLDAP-2.8","UMich","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libldap2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libldap2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-17740","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openldap","version":"2.6.14+dfsg-2"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2017-17740","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-17740","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-17740","date":"2026-11-12","epss":0.07022,"percentile":0.94264}],"risk":0.3511,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-17740","description":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation."},"relatedVulnerabilities":[{"id":"CVE-2017-17740","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-17740","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-17740","date":"2026-11-12","epss":0.07022,"percentile":0.94264}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html","http://www.openldap.org/its/index.cgi/Incoming?id=8759","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-17740","description":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.340415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.340415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.340415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.340415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.32775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.32775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.32775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.32775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-12","epss":0.00419,"percentile":0.36732}],"risk":0.31425000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this."},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-12","epss":0.00419,"percentile":0.36732}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-12","epss":0.00419,"percentile":0.36732}],"risk":0.31425000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this."},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-12","epss":0.00419,"percentile":0.36732}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"1b825b249b1ebaeb","cpes":["cpe:2.3:a:gcc-16-base:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16-base:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16_base:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16_base:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*"],"name":"gcc-16-base","purl":"pkg:deb/debian/gcc-16-base@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/gcc-16-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-16-base:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/gcc-16-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"fix":{"suggestedVersion":"16.2.0-4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"< 16.2.0-4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"fixed","versions":["16.2.0-4"],"available":[{"date":"2026-10-25","kind":"first-observed","version":"16.2.0-4"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"risk":0.311025,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98474","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:98483","https://access.redhat.com/errata/RHSA-2026:98576","https://access.redhat.com/errata/RHSA-2026:98577","https://access.redhat.com/errata/RHSA-2026:98580","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/errata/RHSA-2026:99041","https://access.redhat.com/errata/RHSA-2026:99089","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"8520c2979cc4e2cf","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"fix":{"suggestedVersion":"16.2.0-4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"< 16.2.0-4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"fixed","versions":["16.2.0-4"],"available":[{"date":"2026-10-25","kind":"first-observed","version":"16.2.0-4"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"risk":0.311025,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98474","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:98483","https://access.redhat.com/errata/RHSA-2026:98576","https://access.redhat.com/errata/RHSA-2026:98577","https://access.redhat.com/errata/RHSA-2026:98580","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/errata/RHSA-2026:99041","https://access.redhat.com/errata/RHSA-2026:99089","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"d4533c669aff8d23","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:16.2.0-3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"fix":{"suggestedVersion":"16.2.0-4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"< 16.2.0-4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"fixed","versions":["16.2.0-4"],"available":[{"date":"2026-10-25","kind":"first-observed","version":"16.2.0-4"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"risk":0.311025,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98474","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:98483","https://access.redhat.com/errata/RHSA-2026:98576","https://access.redhat.com/errata/RHSA-2026:98577","https://access.redhat.com/errata/RHSA-2026:98580","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/errata/RHSA-2026:99041","https://access.redhat.com/errata/RHSA-2026:99089","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.297155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.297155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.297155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.297155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"dc3f48400d31e994","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"5a808e4e593d0f84","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"35e83c0ffe516ded","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/debian/libc-gconv-modules-extra@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"9cdc119bd93005b7","cpes":["cpe:2.3:a:libc6:libc6:2.43-7:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"d78fb72dc8211e22","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.43-7:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"ee1fb93e1790b636","cpes":["cpe:2.3:a:libldap2:libldap2:2.6.14\\+dfsg-2:*:*:*:*:*:*:*"],"name":"libldap2","purl":"pkg:deb/debian/libldap2@2.6.14%2Bdfsg-2?arch=amd64&distro=debian&upstream=openldap","type":"deb","version":"2.6.14+dfsg-2","language":"","licenses":["BSD-3-clause","BSD-3-clause-California","BSD-3-clause-variant","BSD-4-clause-California","Beerware","Expat","Expat-ISC","Expat-UNM","F5","FSF-unlimited","GPL-2","GPL-2+","GPL-3","GPL-3+","JCG","MIT-XC","NeoSoft-permissive","OpenLDAP-2.8","UMich","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libldap2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libldap2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-3276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openldap","version":"2.6.14+dfsg-2"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2015-3276","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2015-3276","date":"2026-11-12","epss":0.05269,"percentile":0.9267}],"risk":0.26345,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-3276","description":"The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors."},"relatedVulnerabilities":[{"id":"CVE-2015-3276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-3276","date":"2026-11-12","epss":0.05269,"percentile":0.9267}],"urls":["http://rhn.redhat.com/errata/RHSA-2015-2131.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securitytracker.com/id/1034221","https://bugzilla.redhat.com/show_bug.cgi?id=1238322"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3276","description":"The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors."}]},{"artifact":{"id":"1ceedad7f5af67fe","cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-7:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/debian/tar@1.35%2Bdfsg-7?arch=amd64&distro=debian","type":"deb","version":"1.35+dfsg-7","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5704","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"tar","version":"1.35+dfsg-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-5704","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-11-12","epss":0.00473,"percentile":0.41388}],"risk":0.24832500000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."},"relatedVulnerabilities":[{"id":"CVE-2026-5704","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-11-12","epss":0.00473,"percentile":0.41388}],"urls":["https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:66514","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-5704","https://bugzilla.redhat.com/show_bug.cgi?id=2455360","http://www.openwall.com/lists/oss-security/2026/04/11/10","http://www.openwall.com/lists/oss-security/2026/04/11/11","http://www.openwall.com/lists/oss-security/2026/04/12/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."}]},{"artifact":{"id":"dc3f48400d31e994","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.215325,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.  The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.  LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"5a808e4e593d0f84","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.215325,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.  The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.  LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"35e83c0ffe516ded","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/debian/libc-gconv-modules-extra@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.215325,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.  The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.  LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"9cdc119bd93005b7","cpes":["cpe:2.3:a:libc6:libc6:2.43-7:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.215325,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.  The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.  LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"d78fb72dc8211e22","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.43-7:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.215325,"urls":[],"severity":"High","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.  The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.  LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"1ceedad7f5af67fe","cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-7:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/debian/tar@1.35%2Bdfsg-7?arch=amd64&distro=debian","type":"deb","version":"1.35+dfsg-7","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2005-2541","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"tar","version":"1.35+dfsg-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2005-2541","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-11-12","epss":0.03992,"percentile":0.90659}],"risk":0.1996,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."},"relatedVulnerabilities":[{"id":"CVE-2005-2541","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-11-12","epss":0.03992,"percentile":0.90659}],"urls":["http://marc.info/?l=bugtraq&m=112327628230258&w=2","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."}]},{"artifact":{"id":"74248be0db6ddc14","cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.7.0-8:*:*:*:*:*:*:*"],"name":"libpam-modules","purl":"pkg:deb/debian/libpam-modules@1.7.0-8?arch=amd64&distro=debian&upstream=pam","type":"deb","version":"1.7.0-8","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL-1","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"pam","version":"1.7.0-8"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-54411","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-11-12","epss":0.0032,"percentile":0.25395}],"risk":0.1904,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."},"relatedVulnerabilities":[{"id":"CVE-2026-54411","cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-11-12","epss":0.0032,"percentile":0.25395}],"urls":["https://cwe.mitre.org/data/definitions/208.html","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."}]},{"artifact":{"id":"91f7902a49a048f3","cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.7.0-8:*:*:*:*:*:*:*"],"name":"libpam-modules-bin","purl":"pkg:deb/debian/libpam-modules-bin@1.7.0-8?arch=amd64&distro=debian&upstream=pam","type":"deb","version":"1.7.0-8","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL-1","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postinst"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postrm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postrm"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.prerm"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"pam","version":"1.7.0-8"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-54411","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-11-12","epss":0.0032,"percentile":0.25395}],"risk":0.1904,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."},"relatedVulnerabilities":[{"id":"CVE-2026-54411","cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-11-12","epss":0.0032,"percentile":0.25395}],"urls":["https://cwe.mitre.org/data/definitions/208.html","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."}]},{"artifact":{"id":"336801a07758bebc","cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.7.0-8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.7.0-8:*:*:*:*:*:*:*"],"name":"libpam-runtime","purl":"pkg:deb/debian/libpam-runtime@1.7.0-8?arch=all&distro=debian&upstream=pam","type":"deb","version":"1.7.0-8","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL-1","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"pam","version":"1.7.0-8"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-54411","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-11-12","epss":0.0032,"percentile":0.25395}],"risk":0.1904,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."},"relatedVulnerabilities":[{"id":"CVE-2026-54411","cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-11-12","epss":0.0032,"percentile":0.25395}],"urls":["https://cwe.mitre.org/data/definitions/208.html","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."}]},{"artifact":{"id":"43aeba10c606005a","cpes":["cpe:2.3:a:libpam0g:libpam0g:1.7.0-8:*:*:*:*:*:*:*"],"name":"libpam0g","purl":"pkg:deb/debian/libpam0g@1.7.0-8?arch=amd64&distro=debian&upstream=pam","type":"deb","version":"1.7.0-8","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL-1","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"pam","version":"1.7.0-8"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-54411","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-11-12","epss":0.0032,"percentile":0.25395}],"risk":0.1904,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."},"relatedVulnerabilities":[{"id":"CVE-2026-54411","cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-11-12","epss":0.0032,"percentile":0.25395}],"urls":["https://cwe.mitre.org/data/definitions/208.html","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."}]},{"artifact":{"id":"dc3f48400d31e994","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"risk":0.16245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"5a808e4e593d0f84","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"risk":0.16245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"35e83c0ffe516ded","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/debian/libc-gconv-modules-extra@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"risk":0.16245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"9cdc119bd93005b7","cpes":["cpe:2.3:a:libc6:libc6:2.43-7:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"risk":0.16245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"d78fb72dc8211e22","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.43-7:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"risk":0.16245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"dc3f48400d31e994","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"risk":0.161,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"5a808e4e593d0f84","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"risk":0.161,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"35e83c0ffe516ded","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/debian/libc-gconv-modules-extra@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"risk":0.161,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"9cdc119bd93005b7","cpes":["cpe:2.3:a:libc6:libc6:2.43-7:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"risk":0.161,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"d78fb72dc8211e22","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.43-7:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"risk":0.161,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"dc3f48400d31e994","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"risk":0.15345,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"5a808e4e593d0f84","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"risk":0.15345,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"35e83c0ffe516ded","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/debian/libc-gconv-modules-extra@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"risk":0.15345,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"9cdc119bd93005b7","cpes":["cpe:2.3:a:libc6:libc6:2.43-7:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"risk":0.15345,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"d78fb72dc8211e22","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.43-7:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"risk":0.15345,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"c50904c94a8e63df","cpes":["cpe:2.3:a:login.defs:login.defs:1\\:4.20.3-1:*:*:*:*:*:*:*"],"name":"login.defs","purl":"pkg:deb/debian/login.defs@1%3A4.20.3-1?arch=all&distro=debian&upstream=shadow","type":"deb","version":"1:4.20.3-1","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login.defs/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/login.defs/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.defs.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.defs.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.defs.postinst"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"shadow","version":"1:4.20.3-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-12","epss":0.00426,"percentile":0.37383}],"risk":0.14057999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-12","epss":0.00426,"percentile":0.37383}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"8fdbbe5398eea1c1","cpes":["cpe:2.3:a:passwd:passwd:1\\:4.20.3-1:*:*:*:*:*:*:*"],"name":"passwd","purl":"pkg:deb/debian/passwd@1%3A4.20.3-1?arch=amd64&distro=debian&upstream=shadow","type":"deb","version":"1:4.20.3-1","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"shadow","version":"1:4.20.3-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-12","epss":0.00426,"percentile":0.37383}],"risk":0.14057999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-12","epss":0.00426,"percentile":0.37383}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"dc3f48400d31e994","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4756","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2010-4756","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-11-12","epss":0.02633,"percentile":0.85755}],"risk":0.13165,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."},"relatedVulnerabilities":[{"id":"CVE-2010-4756","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-11-12","epss":0.02633,"percentile":0.85755}],"urls":["http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."}]},{"artifact":{"id":"5a808e4e593d0f84","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4756","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2010-4756","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-11-12","epss":0.02633,"percentile":0.85755}],"risk":0.13165,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."},"relatedVulnerabilities":[{"id":"CVE-2010-4756","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-11-12","epss":0.02633,"percentile":0.85755}],"urls":["http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."}]},{"artifact":{"id":"35e83c0ffe516ded","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/debian/libc-gconv-modules-extra@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4756","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2010-4756","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-11-12","epss":0.02633,"percentile":0.85755}],"risk":0.13165,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."},"relatedVulnerabilities":[{"id":"CVE-2010-4756","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-11-12","epss":0.02633,"percentile":0.85755}],"urls":["http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."}]},{"artifact":{"id":"9cdc119bd93005b7","cpes":["cpe:2.3:a:libc6:libc6:2.43-7:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4756","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2010-4756","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-11-12","epss":0.02633,"percentile":0.85755}],"risk":0.13165,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."},"relatedVulnerabilities":[{"id":"CVE-2010-4756","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-11-12","epss":0.02633,"percentile":0.85755}],"urls":["http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."}]},{"artifact":{"id":"d78fb72dc8211e22","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.43-7:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4756","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2010-4756","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-11-12","epss":0.02633,"percentile":0.85755}],"risk":0.13165,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."},"relatedVulnerabilities":[{"id":"CVE-2010-4756","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-11-12","epss":0.02633,"percentile":0.85755}],"urls":["http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."}]},{"artifact":{"id":"dc3f48400d31e994","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-115819","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"risk":0.12887,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.  These conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.  The narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."},"relatedVulnerabilities":[{"id":"CVE-2026-115819","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34989","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"5a808e4e593d0f84","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-115819","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"risk":0.12887,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.  These conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.  The narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."},"relatedVulnerabilities":[{"id":"CVE-2026-115819","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34989","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"35e83c0ffe516ded","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/debian/libc-gconv-modules-extra@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-115819","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"risk":0.12887,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.  These conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.  The narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."},"relatedVulnerabilities":[{"id":"CVE-2026-115819","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34989","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"9cdc119bd93005b7","cpes":["cpe:2.3:a:libc6:libc6:2.43-7:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-115819","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"risk":0.12887,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.  These conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.  The narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."},"relatedVulnerabilities":[{"id":"CVE-2026-115819","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34989","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"d78fb72dc8211e22","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.43-7:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-115819","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"risk":0.12887,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.  These conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.  The narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."},"relatedVulnerabilities":[{"id":"CVE-2026-115819","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34989","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"ee1fb93e1790b636","cpes":["cpe:2.3:a:libldap2:libldap2:2.6.14\\+dfsg-2:*:*:*:*:*:*:*"],"name":"libldap2","purl":"pkg:deb/debian/libldap2@2.6.14%2Bdfsg-2?arch=amd64&distro=debian&upstream=openldap","type":"deb","version":"2.6.14+dfsg-2","language":"","licenses":["BSD-3-clause","BSD-3-clause-California","BSD-3-clause-variant","BSD-4-clause-California","Beerware","Expat","Expat-ISC","Expat-UNM","F5","FSF-unlimited","GPL-2","GPL-2+","GPL-3","GPL-3+","JCG","MIT-XC","NeoSoft-permissive","OpenLDAP-2.8","UMich","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libldap2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libldap2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-15719","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openldap","version":"2.6.14+dfsg-2"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2020-15719","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-15719","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-15719","date":"2026-11-12","epss":0.02515,"percentile":0.85042}],"risk":0.12575,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-15719","description":"libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux."},"relatedVulnerabilities":[{"id":"CVE-2020-15719","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-15719","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-15719","date":"2026-11-12","epss":0.02515,"percentile":0.85042}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html","https://access.redhat.com/errata/RHBA-2019:3674","https://bugs.openldap.org/show_bug.cgi?id=9266","https://bugzilla.redhat.com/show_bug.cgi?id=1740070","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15719","description":"libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux."}]},{"artifact":{"id":"dc3f48400d31e994","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010025","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010025","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-11-12","epss":0.02478,"percentile":0.84799}],"risk":0.12390000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2019-1010025","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-11-12","epss":0.02478,"percentile":0.84799}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."}]},{"artifact":{"id":"5a808e4e593d0f84","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010025","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010025","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-11-12","epss":0.02478,"percentile":0.84799}],"risk":0.12390000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2019-1010025","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-11-12","epss":0.02478,"percentile":0.84799}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."}]},{"artifact":{"id":"35e83c0ffe516ded","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/debian/libc-gconv-modules-extra@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010025","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010025","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-11-12","epss":0.02478,"percentile":0.84799}],"risk":0.12390000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2019-1010025","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-11-12","epss":0.02478,"percentile":0.84799}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."}]},{"artifact":{"id":"9cdc119bd93005b7","cpes":["cpe:2.3:a:libc6:libc6:2.43-7:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010025","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010025","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-11-12","epss":0.02478,"percentile":0.84799}],"risk":0.12390000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2019-1010025","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-11-12","epss":0.02478,"percentile":0.84799}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."}]},{"artifact":{"id":"d78fb72dc8211e22","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.43-7:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010025","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-1010025","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-11-12","epss":0.02478,"percentile":0.84799}],"risk":0.12390000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2019-1010025","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-11-12","epss":0.02478,"percentile":0.84799}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."}]},{"artifact":{"id":"dc3f48400d31e994","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9192","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-9192","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-11-12","epss":0.02447,"percentile":0.84586}],"risk":0.12235,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"},"relatedVulnerabilities":[{"id":"CVE-2019-9192","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-11-12","epss":0.02447,"percentile":0.84586}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"}]},{"artifact":{"id":"5a808e4e593d0f84","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9192","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-9192","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-11-12","epss":0.02447,"percentile":0.84586}],"risk":0.12235,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"},"relatedVulnerabilities":[{"id":"CVE-2019-9192","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-11-12","epss":0.02447,"percentile":0.84586}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"}]},{"artifact":{"id":"35e83c0ffe516ded","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/debian/libc-gconv-modules-extra@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9192","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-9192","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-11-12","epss":0.02447,"percentile":0.84586}],"risk":0.12235,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"},"relatedVulnerabilities":[{"id":"CVE-2019-9192","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-11-12","epss":0.02447,"percentile":0.84586}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"}]},{"artifact":{"id":"9cdc119bd93005b7","cpes":["cpe:2.3:a:libc6:libc6:2.43-7:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9192","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-9192","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-11-12","epss":0.02447,"percentile":0.84586}],"risk":0.12235,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"},"relatedVulnerabilities":[{"id":"CVE-2019-9192","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-11-12","epss":0.02447,"percentile":0.84586}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"}]},{"artifact":{"id":"d78fb72dc8211e22","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.43-7:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9192","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2019-9192","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-11-12","epss":0.02447,"percentile":0.84586}],"risk":0.12235,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"},"relatedVulnerabilities":[{"id":"CVE-2019-9192","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-11-12","epss":0.02447,"percentile":0.84586}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"}]},{"artifact":{"id":"dc3f48400d31e994","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-100290","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"risk":0.11255999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.  An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."},"relatedVulnerabilities":[{"id":"CVE-2026-100290","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=31935","https://sourceware.org/bugzilla/show_bug.cgi?id=34991","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"5a808e4e593d0f84","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.43-7:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-100290","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"risk":0.11255999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.  An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."},"relatedVulnerabilities":[{"id":"CVE-2026-100290","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=31935","https://sourceware.org/bugzilla/show_bug.cgi?id=34991","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"35e83c0ffe516ded","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-7:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/debian/libc-gconv-modules-extra@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-100290","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"risk":0.11255999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.  An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."},"relatedVulnerabilities":[{"id":"CVE-2026-100290","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=31935","https://sourceware.org/bugzilla/show_bug.cgi?id=34991","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"9cdc119bd93005b7","cpes":["cpe:2.3:a:libc6:libc6:2.43-7:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-100290","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"risk":0.11255999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.  An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."},"relatedVulnerabilities":[{"id":"CVE-2026-100290","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=31935","https://sourceware.org/bugzilla/show_bug.cgi?id=34991","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"d78fb72dc8211e22","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.43-7:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.43-7:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.43-7?arch=amd64&distro=debian&upstream=glibc","type":"deb","version":"2.43-7","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"glibc","version":"2.43-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-100290","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"risk":0.11255999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.  An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."},"relatedVulnerabilities":[{"id":"CVE-2026-100290","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=31935","https://sourceware.org/bugzilla/show_bug.cgi?id=34991","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"5131cccc6c3902b5","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.6.5-1:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95692","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-95692","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"risk":0.1055,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce length via EVP_CipherInit_ex() may trigger a heap out-of-bounds read. Supplying a longer IV is silently truncated instead of rejected.  Impact summary: An application passing a caller-supplied IV of the wrong length may crash or read beyond its buffer. Because trailing IV bytes are ignored, an attacker who knows one message and tag may forge messages under a different IV.  CWE: CWE-125: Out-of-bounds Read  Description: AES-GCM-SIV copies the caller-supplied IV or nonce into its internal state using a copy whose length is taken from the expected nonce size rather than from the length the caller actually provided. When the caller passes a shorter IV, the copy reads past the end of the caller's buffer; AddressSanitizer confirms a heap out-of-bounds read reached through EVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a longer IV, the implementation silently discards the trailing bytes instead of rejecting the length.  The truncation breaks the binding between the IV and the computed authentication tag. An attacker who has observed a message and its tag under one IV can produce a message and tag that verify under a different IV whose first bytes match, since the surplus bytes never influence the computation. The message itself is unchanged, so this is a failure of IV commitment rather than a classic existential forgery.  Only applications that call EVP_CipherInit_ex() (or the equivalent provider cipher initialization) with an IV length other than the standard 12 bytes for AES-GCM-SIV are affected. The severity is limited because the out-of-bounds read is small and attacker-controlled only in length, and the forgery requires an unusual IV length choice by the application.  FIPS impact: no The FIPS modules are not affected by this issue, as AES-GCM-SIV is not an approved algorithm."},"relatedVulnerabilities":[{"id":"CVE-2026-95692","cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"urls":["https://github.com/openssl/openssl/commit/257a3427aa0ef8d9dd2ef5b3e2d1c021a221b116","https://github.com/openssl/openssl/commit/510872388f5d145cf870868b3d288a23822cb776","https://github.com/openssl/openssl/commit/70a47ac78b6f3be1b22fb1551bd0bfcff4f29613","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce\nlength via EVP_CipherInit_ex() may trigger a heap out-of-bounds read.\nSupplying a longer IV is silently truncated instead of rejected.\n\nImpact summary: An application passing a caller-supplied IV of the wrong\nlength may crash or read beyond its buffer. Because trailing IV bytes are\nignored, an attacker who knows one message and tag may forge messages under a\ndifferent IV.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: AES-GCM-SIV copies the caller-supplied IV or nonce into its\ninternal state using a copy whose length is taken from the expected nonce size\nrather than from the length the caller actually provided. When the caller\npasses a shorter IV, the copy reads past the end of the caller's buffer;\nAddressSanitizer confirms a heap out-of-bounds read reached through\nEVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a\nlonger IV, the implementation silently discards the trailing bytes instead of\nrejecting the length.\n\nThe truncation breaks the binding between the IV and the computed\nauthentication tag. An attacker who has observed a message and its tag under\none IV can produce a message and tag that verify under a different IV whose\nfirst bytes match, since the surplus bytes never influence the computation.\nThe message itself is unchanged, so this is a failure of IV commitment rather\nthan a classic existential forgery.\n\nOnly applications that call EVP_CipherInit_ex() (or the equivalent provider\ncipher initialization) with an IV length other than the standard 12 bytes for\nAES-GCM-SIV are affected. The severity is limited because the out-of-bounds\nread is small and attacker-controlled only in length, and the forgery requires\nan unusual IV length choice by the application.\n\nFIPS impact: no\nThe FIPS modules are not affected by this issue, as AES-GCM-SIV is not an\napproved algorithm."}]},{"artifact":{"id":"ce8b6147b5899737","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.6.5-1:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/debian/libssl3t64@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95692","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-95692","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"risk":0.1055,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce length via EVP_CipherInit_ex() may trigger a heap out-of-bounds read. Supplying a longer IV is silently truncated instead of rejected.  Impact summary: An application passing a caller-supplied IV of the wrong length may crash or read beyond its buffer. Because trailing IV bytes are ignored, an attacker who knows one message and tag may forge messages under a different IV.  CWE: CWE-125: Out-of-bounds Read  Description: AES-GCM-SIV copies the caller-supplied IV or nonce into its internal state using a copy whose length is taken from the expected nonce size rather than from the length the caller actually provided. When the caller passes a shorter IV, the copy reads past the end of the caller's buffer; AddressSanitizer confirms a heap out-of-bounds read reached through EVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a longer IV, the implementation silently discards the trailing bytes instead of rejecting the length.  The truncation breaks the binding between the IV and the computed authentication tag. An attacker who has observed a message and its tag under one IV can produce a message and tag that verify under a different IV whose first bytes match, since the surplus bytes never influence the computation. The message itself is unchanged, so this is a failure of IV commitment rather than a classic existential forgery.  Only applications that call EVP_CipherInit_ex() (or the equivalent provider cipher initialization) with an IV length other than the standard 12 bytes for AES-GCM-SIV are affected. The severity is limited because the out-of-bounds read is small and attacker-controlled only in length, and the forgery requires an unusual IV length choice by the application.  FIPS impact: no The FIPS modules are not affected by this issue, as AES-GCM-SIV is not an approved algorithm."},"relatedVulnerabilities":[{"id":"CVE-2026-95692","cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"urls":["https://github.com/openssl/openssl/commit/257a3427aa0ef8d9dd2ef5b3e2d1c021a221b116","https://github.com/openssl/openssl/commit/510872388f5d145cf870868b3d288a23822cb776","https://github.com/openssl/openssl/commit/70a47ac78b6f3be1b22fb1551bd0bfcff4f29613","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce\nlength via EVP_CipherInit_ex() may trigger a heap out-of-bounds read.\nSupplying a longer IV is silently truncated instead of rejected.\n\nImpact summary: An application passing a caller-supplied IV of the wrong\nlength may crash or read beyond its buffer. Because trailing IV bytes are\nignored, an attacker who knows one message and tag may forge messages under a\ndifferent IV.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: AES-GCM-SIV copies the caller-supplied IV or nonce into its\ninternal state using a copy whose length is taken from the expected nonce size\nrather than from the length the caller actually provided. When the caller\npasses a shorter IV, the copy reads past the end of the caller's buffer;\nAddressSanitizer confirms a heap out-of-bounds read reached through\nEVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a\nlonger IV, the implementation silently discards the trailing bytes instead of\nrejecting the length.\n\nThe truncation breaks the binding between the IV and the computed\nauthentication tag. An attacker who has observed a message and its tag under\none IV can produce a message and tag that verify under a different IV whose\nfirst bytes match, since the surplus bytes never influence the computation.\nThe message itself is unchanged, so this is a failure of IV commitment rather\nthan a classic existential forgery.\n\nOnly applications that call EVP_CipherInit_ex() (or the equivalent provider\ncipher initialization) with an IV length other than the standard 12 bytes for\nAES-GCM-SIV are affected. The severity is limited because the out-of-bounds\nread is small and attacker-controlled only in length, and the forgery requires\nan unusual IV length choice by the application.\n\nFIPS impact: no\nThe FIPS modules are not affected by this issue, as AES-GCM-SIV is not an\napproved algorithm."}]},{"artifact":{"id":"04ecda1d3ae678e9","cpes":["cpe:2.3:a:openssl:openssl:3.6.5-1:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@3.6.5-1?arch=amd64&distro=debian","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95692","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-95692","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"risk":0.1055,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce length via EVP_CipherInit_ex() may trigger a heap out-of-bounds read. Supplying a longer IV is silently truncated instead of rejected.  Impact summary: An application passing a caller-supplied IV of the wrong length may crash or read beyond its buffer. Because trailing IV bytes are ignored, an attacker who knows one message and tag may forge messages under a different IV.  CWE: CWE-125: Out-of-bounds Read  Description: AES-GCM-SIV copies the caller-supplied IV or nonce into its internal state using a copy whose length is taken from the expected nonce size rather than from the length the caller actually provided. When the caller passes a shorter IV, the copy reads past the end of the caller's buffer; AddressSanitizer confirms a heap out-of-bounds read reached through EVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a longer IV, the implementation silently discards the trailing bytes instead of rejecting the length.  The truncation breaks the binding between the IV and the computed authentication tag. An attacker who has observed a message and its tag under one IV can produce a message and tag that verify under a different IV whose first bytes match, since the surplus bytes never influence the computation. The message itself is unchanged, so this is a failure of IV commitment rather than a classic existential forgery.  Only applications that call EVP_CipherInit_ex() (or the equivalent provider cipher initialization) with an IV length other than the standard 12 bytes for AES-GCM-SIV are affected. The severity is limited because the out-of-bounds read is small and attacker-controlled only in length, and the forgery requires an unusual IV length choice by the application.  FIPS impact: no The FIPS modules are not affected by this issue, as AES-GCM-SIV is not an approved algorithm."},"relatedVulnerabilities":[{"id":"CVE-2026-95692","cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"urls":["https://github.com/openssl/openssl/commit/257a3427aa0ef8d9dd2ef5b3e2d1c021a221b116","https://github.com/openssl/openssl/commit/510872388f5d145cf870868b3d288a23822cb776","https://github.com/openssl/openssl/commit/70a47ac78b6f3be1b22fb1551bd0bfcff4f29613","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce\nlength via EVP_CipherInit_ex() may trigger a heap out-of-bounds read.\nSupplying a longer IV is silently truncated instead of rejected.\n\nImpact summary: An application passing a caller-supplied IV of the wrong\nlength may crash or read beyond its buffer. Because trailing IV bytes are\nignored, an attacker who knows one message and tag may forge messages under a\ndifferent IV.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: AES-GCM-SIV copies the caller-supplied IV or nonce into its\ninternal state using a copy whose length is taken from the expected nonce size\nrather than from the length the caller actually provided. When the caller\npasses a shorter IV, the copy reads past the end of the caller's buffer;\nAddressSanitizer confirms a heap out-of-bounds read reached through\nEVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a\nlonger IV, the implementation silently discards the trailing bytes instead of\nrejecting the length.\n\nThe truncation breaks the binding between the IV and the computed\nauthentication tag. An attacker who has observed a message and its tag under\none IV can produce a message and tag that verify under a different IV whose\nfirst bytes match, since the surplus bytes never influence the computation.\nThe message itself is unchanged, so this is a failure of IV commitment rather\nthan a classic existential forgery.\n\nOnly applications that call EVP_CipherInit_ex() (or the equivalent provider\ncipher initialization) with an IV length other than the standard 12 bytes for\nAES-GCM-SIV are affected. The severity is limited because the out-of-bounds\nread is small and attacker-controlled only in length, and the forgery requires\nan unusual IV length choice by the application.\n\nFIPS impact: no\nThe FIPS modules are not affected by this issue, as AES-GCM-SIV is not an\napproved algorithm."}]},{"artifact":{"id":"e9f205aa14b757fd","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/debian/openssl-provider-legacy@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95692","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-95692","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"risk":0.1055,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce length via EVP_CipherInit_ex() may trigger a heap out-of-bounds read. Supplying a longer IV is silently truncated instead of rejected.  Impact summary: An application passing a caller-supplied IV of the wrong length may crash or read beyond its buffer. Because trailing IV bytes are ignored, an attacker who knows one message and tag may forge messages under a different IV.  CWE: CWE-125: Out-of-bounds Read  Description: AES-GCM-SIV copies the caller-supplied IV or nonce into its internal state using a copy whose length is taken from the expected nonce size rather than from the length the caller actually provided. When the caller passes a shorter IV, the copy reads past the end of the caller's buffer; AddressSanitizer confirms a heap out-of-bounds read reached through EVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a longer IV, the implementation silently discards the trailing bytes instead of rejecting the length.  The truncation breaks the binding between the IV and the computed authentication tag. An attacker who has observed a message and its tag under one IV can produce a message and tag that verify under a different IV whose first bytes match, since the surplus bytes never influence the computation. The message itself is unchanged, so this is a failure of IV commitment rather than a classic existential forgery.  Only applications that call EVP_CipherInit_ex() (or the equivalent provider cipher initialization) with an IV length other than the standard 12 bytes for AES-GCM-SIV are affected. The severity is limited because the out-of-bounds read is small and attacker-controlled only in length, and the forgery requires an unusual IV length choice by the application.  FIPS impact: no The FIPS modules are not affected by this issue, as AES-GCM-SIV is not an approved algorithm."},"relatedVulnerabilities":[{"id":"CVE-2026-95692","cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"urls":["https://github.com/openssl/openssl/commit/257a3427aa0ef8d9dd2ef5b3e2d1c021a221b116","https://github.com/openssl/openssl/commit/510872388f5d145cf870868b3d288a23822cb776","https://github.com/openssl/openssl/commit/70a47ac78b6f3be1b22fb1551bd0bfcff4f29613","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce\nlength via EVP_CipherInit_ex() may trigger a heap out-of-bounds read.\nSupplying a longer IV is silently truncated instead of rejected.\n\nImpact summary: An application passing a caller-supplied IV of the wrong\nlength may crash or read beyond its buffer. Because trailing IV bytes are\nignored, an attacker who knows one message and tag may forge messages under a\ndifferent IV.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: AES-GCM-SIV copies the caller-supplied IV or nonce into its\ninternal state using a copy whose length is taken from the expected nonce size\nrather than from the length the caller actually provided. When the caller\npasses a shorter IV, the copy reads past the end of the caller's buffer;\nAddressSanitizer confirms a heap out-of-bounds read reached through\nEVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a\nlonger IV, the implementation silently discards the trailing bytes instead of\nrejecting the length.\n\nThe truncation breaks the binding between the IV and the computed\nauthentication tag. An attacker who has observed a message and its tag under\none IV can produce a message and tag that verify under a different IV whose\nfirst bytes match, since the surplus bytes never influence the computation.\nThe message itself is unchanged, so this is a failure of IV commitment rather\nthan a classic existential forgery.\n\nOnly applications that call EVP_CipherInit_ex() (or the equivalent provider\ncipher initialization) with an IV length other than the standard 12 bytes for\nAES-GCM-SIV are affected. The severity is limited because the out-of-bounds\nread is small and attacker-controlled only in length, and the forgery requires\nan unusual IV length choice by the application.\n\nFIPS impact: no\nThe FIPS modules are not affected by this issue, as AES-GCM-SIV is not an\napproved algorithm."}]},{"artifact":{"id":"1b825b249b1ebaeb","cpes":["cpe:2.3:a:gcc-16-base:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16-base:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16_base:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16_base:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*"],"name":"gcc-16-base","purl":"pkg:deb/debian/gcc-16-base@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/gcc-16-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-16-base:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/gcc-16-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115456","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-115456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-12","epss":0.00313,"percentile":0.24554}],"risk":0.10485499999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-115456","description":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."},"relatedVulnerabilities":[{"id":"CVE-2026-115456","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-12","epss":0.00313,"percentile":0.24554}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-115456","https://bugzilla.redhat.com/show_bug.cgi?id=2563044"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115456","description":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."}]},{"artifact":{"id":"8520c2979cc4e2cf","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115456","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-115456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-12","epss":0.00313,"percentile":0.24554}],"risk":0.10485499999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-115456","description":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."},"relatedVulnerabilities":[{"id":"CVE-2026-115456","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-12","epss":0.00313,"percentile":0.24554}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-115456","https://bugzilla.redhat.com/show_bug.cgi?id=2563044"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115456","description":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."}]},{"artifact":{"id":"d4533c669aff8d23","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:16.2.0-3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115456","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-115456","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-12","epss":0.00313,"percentile":0.24554}],"risk":0.10485499999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-115456","description":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."},"relatedVulnerabilities":[{"id":"CVE-2026-115456","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-12","epss":0.00313,"percentile":0.24554}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-115456","https://bugzilla.redhat.com/show_bug.cgi?id=2563044"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115456","description":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2018-5709","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-12","epss":0.02049,"percentile":0.81511}],"risk":0.10245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."},"relatedVulnerabilities":[{"id":"CVE-2018-5709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-12","epss":0.02049,"percentile":0.81511}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2018-5709","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-12","epss":0.02049,"percentile":0.81511}],"risk":0.10245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."},"relatedVulnerabilities":[{"id":"CVE-2018-5709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-12","epss":0.02049,"percentile":0.81511}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2018-5709","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-12","epss":0.02049,"percentile":0.81511}],"risk":0.10245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."},"relatedVulnerabilities":[{"id":"CVE-2018-5709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-12","epss":0.02049,"percentile":0.81511}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2018-5709","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-12","epss":0.02049,"percentile":0.81511}],"risk":0.10245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."},"relatedVulnerabilities":[{"id":"CVE-2018-5709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-12","epss":0.02049,"percentile":0.81511}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."}]},{"artifact":{"id":"5131cccc6c3902b5","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.6.5-1:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-88822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"risk":0.095,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets.  Impact summary: Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network traffic.  CWE: CWE-457 (Use of Uninitialized Variable)  Description: The OpenSSL QUIC stack contains a feature in which, when using an already connected socket, it will auto-detect the peer address during the SSL handshake.  This feature uses the getpeername() function, passing a buffer of sufficient length to hold any supported address family, but passes a buffer length that is only sized such that larger addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full address length, which is accepted as the valid input buffer length, leading to the address buffer containing uninitialized stack data instead of the actual peer address. The invalid peer address is then used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the uninitialized stack data to passive network observers.  FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module."},"relatedVulnerabilities":[{"id":"CVE-2026-88822","cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"urls":["https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75","https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88","https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow\nuninitialized stack data to leak into the received address which is then used\nas the destination for outgoing packets.\n\nImpact summary: Applications using QUIC's automated peer detection mechanism\nmay receive an invalid address, leading to connection loss and disclosure of\nuninitialized stack data to an attacker observing the outgoing network traffic.\n\nCWE: CWE-457 (Use of Uninitialized Variable)\n\nDescription: The OpenSSL QUIC stack contains a feature in which, when using an\nalready connected socket, it will auto-detect the peer address during the SSL\nhandshake.  This feature uses the getpeername() function, passing a buffer of\nsufficient length to hold any supported address family, but passes a buffer\nlength that is only sized such that larger addresses, such as IPv6, cannot be\nretrieved. The getpeername() function however, still returns the full address\nlength, which is accepted as the valid input buffer length, leading to the\naddress buffer containing uninitialized stack data instead of the actual peer\naddress. The invalid peer address is then used as destination for the outgoing\npackets which leads to a connectivity breakage and a leakage of the\nuninitialized stack data to passive network observers.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as\nthe affected protocol is not implemented in the FIPS module."}]},{"artifact":{"id":"ce8b6147b5899737","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.6.5-1:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/debian/libssl3t64@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-88822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"risk":0.095,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets.  Impact summary: Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network traffic.  CWE: CWE-457 (Use of Uninitialized Variable)  Description: The OpenSSL QUIC stack contains a feature in which, when using an already connected socket, it will auto-detect the peer address during the SSL handshake.  This feature uses the getpeername() function, passing a buffer of sufficient length to hold any supported address family, but passes a buffer length that is only sized such that larger addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full address length, which is accepted as the valid input buffer length, leading to the address buffer containing uninitialized stack data instead of the actual peer address. The invalid peer address is then used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the uninitialized stack data to passive network observers.  FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module."},"relatedVulnerabilities":[{"id":"CVE-2026-88822","cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"urls":["https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75","https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88","https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow\nuninitialized stack data to leak into the received address which is then used\nas the destination for outgoing packets.\n\nImpact summary: Applications using QUIC's automated peer detection mechanism\nmay receive an invalid address, leading to connection loss and disclosure of\nuninitialized stack data to an attacker observing the outgoing network traffic.\n\nCWE: CWE-457 (Use of Uninitialized Variable)\n\nDescription: The OpenSSL QUIC stack contains a feature in which, when using an\nalready connected socket, it will auto-detect the peer address during the SSL\nhandshake.  This feature uses the getpeername() function, passing a buffer of\nsufficient length to hold any supported address family, but passes a buffer\nlength that is only sized such that larger addresses, such as IPv6, cannot be\nretrieved. The getpeername() function however, still returns the full address\nlength, which is accepted as the valid input buffer length, leading to the\naddress buffer containing uninitialized stack data instead of the actual peer\naddress. The invalid peer address is then used as destination for the outgoing\npackets which leads to a connectivity breakage and a leakage of the\nuninitialized stack data to passive network observers.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as\nthe affected protocol is not implemented in the FIPS module."}]},{"artifact":{"id":"04ecda1d3ae678e9","cpes":["cpe:2.3:a:openssl:openssl:3.6.5-1:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@3.6.5-1?arch=amd64&distro=debian","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-88822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"risk":0.095,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets.  Impact summary: Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network traffic.  CWE: CWE-457 (Use of Uninitialized Variable)  Description: The OpenSSL QUIC stack contains a feature in which, when using an already connected socket, it will auto-detect the peer address during the SSL handshake.  This feature uses the getpeername() function, passing a buffer of sufficient length to hold any supported address family, but passes a buffer length that is only sized such that larger addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full address length, which is accepted as the valid input buffer length, leading to the address buffer containing uninitialized stack data instead of the actual peer address. The invalid peer address is then used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the uninitialized stack data to passive network observers.  FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module."},"relatedVulnerabilities":[{"id":"CVE-2026-88822","cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"urls":["https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75","https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88","https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow\nuninitialized stack data to leak into the received address which is then used\nas the destination for outgoing packets.\n\nImpact summary: Applications using QUIC's automated peer detection mechanism\nmay receive an invalid address, leading to connection loss and disclosure of\nuninitialized stack data to an attacker observing the outgoing network traffic.\n\nCWE: CWE-457 (Use of Uninitialized Variable)\n\nDescription: The OpenSSL QUIC stack contains a feature in which, when using an\nalready connected socket, it will auto-detect the peer address during the SSL\nhandshake.  This feature uses the getpeername() function, passing a buffer of\nsufficient length to hold any supported address family, but passes a buffer\nlength that is only sized such that larger addresses, such as IPv6, cannot be\nretrieved. The getpeername() function however, still returns the full address\nlength, which is accepted as the valid input buffer length, leading to the\naddress buffer containing uninitialized stack data instead of the actual peer\naddress. The invalid peer address is then used as destination for the outgoing\npackets which leads to a connectivity breakage and a leakage of the\nuninitialized stack data to passive network observers.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as\nthe affected protocol is not implemented in the FIPS module."}]},{"artifact":{"id":"e9f205aa14b757fd","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/debian/openssl-provider-legacy@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-88822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"risk":0.095,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets.  Impact summary: Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network traffic.  CWE: CWE-457 (Use of Uninitialized Variable)  Description: The OpenSSL QUIC stack contains a feature in which, when using an already connected socket, it will auto-detect the peer address during the SSL handshake.  This feature uses the getpeername() function, passing a buffer of sufficient length to hold any supported address family, but passes a buffer length that is only sized such that larger addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full address length, which is accepted as the valid input buffer length, leading to the address buffer containing uninitialized stack data instead of the actual peer address. The invalid peer address is then used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the uninitialized stack data to passive network observers.  FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module."},"relatedVulnerabilities":[{"id":"CVE-2026-88822","cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"urls":["https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75","https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88","https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow\nuninitialized stack data to leak into the received address which is then used\nas the destination for outgoing packets.\n\nImpact summary: Applications using QUIC's automated peer detection mechanism\nmay receive an invalid address, leading to connection loss and disclosure of\nuninitialized stack data to an attacker observing the outgoing network traffic.\n\nCWE: CWE-457 (Use of Uninitialized Variable)\n\nDescription: The OpenSSL QUIC stack contains a feature in which, when using an\nalready connected socket, it will auto-detect the peer address during the SSL\nhandshake.  This feature uses the getpeername() function, passing a buffer of\nsufficient length to hold any supported address family, but passes a buffer\nlength that is only sized such that larger addresses, such as IPv6, cannot be\nretrieved. The getpeername() function however, still returns the full address\nlength, which is accepted as the valid input buffer length, leading to the\naddress buffer containing uninitialized stack data instead of the actual peer\naddress. The invalid peer address is then used as destination for the outgoing\npackets which leads to a connectivity breakage and a leakage of the\nuninitialized stack data to passive network observers.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as\nthe affected protocol is not implemented in the FIPS module."}]},{"artifact":{"id":"5131cccc6c3902b5","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.6.5-1:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-95691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"risk":0.095,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage while the TLS record layer retains a direct pointer into that storage causing use after free.  Impact summary: A malicious QUIC server can cause a heap-use-after-free read in the OpenSSL QUIC client. The server can also identify one allocator-adjacent byte through the client's protected Handshake response.  CWE: CWE-416: Use After Free  Description: During CRYPTO stream processing, a pointer into the first frame's memory on the stream is lent to the TLS handshake processing. The memory must remain stable until it is processed and released. However the processing of retransmitted CRYPTO frames could release the memory if the retransmitted frame fully overlapped the existing frame. This then causes use-after-free read when the TLS handshake processing continues.  The use-after-free read can lead to a Denial-of-Service of the client application or a minor leak of information about the heap memory contents that might be overwritten with other data, subsequently allocated by the application, to the peer.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-95691","cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"urls":["https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"ce8b6147b5899737","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.6.5-1:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/debian/libssl3t64@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-95691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"risk":0.095,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage while the TLS record layer retains a direct pointer into that storage causing use after free.  Impact summary: A malicious QUIC server can cause a heap-use-after-free read in the OpenSSL QUIC client. The server can also identify one allocator-adjacent byte through the client's protected Handshake response.  CWE: CWE-416: Use After Free  Description: During CRYPTO stream processing, a pointer into the first frame's memory on the stream is lent to the TLS handshake processing. The memory must remain stable until it is processed and released. However the processing of retransmitted CRYPTO frames could release the memory if the retransmitted frame fully overlapped the existing frame. This then causes use-after-free read when the TLS handshake processing continues.  The use-after-free read can lead to a Denial-of-Service of the client application or a minor leak of information about the heap memory contents that might be overwritten with other data, subsequently allocated by the application, to the peer.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-95691","cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"urls":["https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"04ecda1d3ae678e9","cpes":["cpe:2.3:a:openssl:openssl:3.6.5-1:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@3.6.5-1?arch=amd64&distro=debian","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-95691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"risk":0.095,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage while the TLS record layer retains a direct pointer into that storage causing use after free.  Impact summary: A malicious QUIC server can cause a heap-use-after-free read in the OpenSSL QUIC client. The server can also identify one allocator-adjacent byte through the client's protected Handshake response.  CWE: CWE-416: Use After Free  Description: During CRYPTO stream processing, a pointer into the first frame's memory on the stream is lent to the TLS handshake processing. The memory must remain stable until it is processed and released. However the processing of retransmitted CRYPTO frames could release the memory if the retransmitted frame fully overlapped the existing frame. This then causes use-after-free read when the TLS handshake processing continues.  The use-after-free read can lead to a Denial-of-Service of the client application or a minor leak of information about the heap memory contents that might be overwritten with other data, subsequently allocated by the application, to the peer.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-95691","cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"urls":["https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"e9f205aa14b757fd","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/debian/openssl-provider-legacy@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-95691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"risk":0.095,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage while the TLS record layer retains a direct pointer into that storage causing use after free.  Impact summary: A malicious QUIC server can cause a heap-use-after-free read in the OpenSSL QUIC client. The server can also identify one allocator-adjacent byte through the client's protected Handshake response.  CWE: CWE-416: Use After Free  Description: During CRYPTO stream processing, a pointer into the first frame's memory on the stream is lent to the TLS handshake processing. The memory must remain stable until it is processed and released. However the processing of retransmitted CRYPTO frames could release the memory if the retransmitted frame fully overlapped the existing frame. This then causes use-after-free read when the TLS handshake processing continues.  The use-after-free read can lead to a Denial-of-Service of the client application or a minor leak of information about the heap memory contents that might be overwritten with other data, subsequently allocated by the application, to the peer.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-95691","cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"urls":["https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"6c639d2a48be13c9","cpes":["cpe:2.3:a:perl-base:perl-base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.42.3-1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.42.3-1?arch=amd64&distro=debian&upstream=perl","type":"deb","version":"5.42.3-1","language":"","licenses":["Artistic","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","DRAND48","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"perl","version":"5.42.3-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"risk":0.08774000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.  The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.  A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-12","epss":0.00164,"percentile":0.05711}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"1b825b249b1ebaeb","cpes":["cpe:2.3:a:gcc-16-base:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16-base:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16_base:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16_base:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*"],"name":"gcc-16-base","purl":"pkg:deb/debian/gcc-16-base@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/gcc-16-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-16-base:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/gcc-16-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114690","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-114690","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-12","epss":0.00132,"percentile":0.02815}],"risk":0.07392000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-114690","description":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-114690","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-12","epss":0.00132,"percentile":0.02815}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114690","https://bugzilla.redhat.com/show_bug.cgi?id=2478652"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114690","description":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"8520c2979cc4e2cf","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114690","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-114690","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-12","epss":0.00132,"percentile":0.02815}],"risk":0.07392000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-114690","description":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-114690","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-12","epss":0.00132,"percentile":0.02815}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114690","https://bugzilla.redhat.com/show_bug.cgi?id=2478652"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114690","description":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"d4533c669aff8d23","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:16.2.0-3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114690","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-114690","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-12","epss":0.00132,"percentile":0.02815}],"risk":0.07392000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-114690","description":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-114690","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-12","epss":0.00132,"percentile":0.02815}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114690","https://bugzilla.redhat.com/show_bug.cgi?id=2478652"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114690","description":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"5131cccc6c3902b5","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.6.5-1:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-88823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"risk":0.07100000000000001,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment.  Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message.  CWE: CWE-325: Missing Cryptographic Step  Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message.  The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD.  FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-88823","cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"urls":["https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4","https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682","https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}]},{"artifact":{"id":"ce8b6147b5899737","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.6.5-1:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/debian/libssl3t64@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-88823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"risk":0.07100000000000001,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment.  Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message.  CWE: CWE-325: Missing Cryptographic Step  Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message.  The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD.  FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-88823","cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"urls":["https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4","https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682","https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}]},{"artifact":{"id":"04ecda1d3ae678e9","cpes":["cpe:2.3:a:openssl:openssl:3.6.5-1:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@3.6.5-1?arch=amd64&distro=debian","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-88823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"risk":0.07100000000000001,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment.  Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message.  CWE: CWE-325: Missing Cryptographic Step  Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message.  The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD.  FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-88823","cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"urls":["https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4","https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682","https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}]},{"artifact":{"id":"e9f205aa14b757fd","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/debian/openssl-provider-legacy@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-88823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"risk":0.07100000000000001,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment.  Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message.  CWE: CWE-325: Missing Cryptographic Step  Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message.  The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD.  FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-88823","cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"urls":["https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4","https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682","https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}]},{"artifact":{"id":"1ceedad7f5af67fe","cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-7:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/debian/tar@1.35%2Bdfsg-7?arch=amd64&distro=debian","type":"deb","version":"1.35+dfsg-7","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18508","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"tar","version":"1.35+dfsg-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-18508","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18508","date":"2026-11-12","epss":0.00141,"percentile":0.03484}],"risk":0.06627,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-18508","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction."},"relatedVulnerabilities":[{"id":"CVE-2026-18508","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18508","date":"2026-11-12","epss":0.00141,"percentile":0.03484}],"urls":["https://access.redhat.com/errata/RHSA-2026:50807","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18508","https://bugzilla.redhat.com/show_bug.cgi?id=2509843"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction."}]},{"artifact":{"id":"5131cccc6c3902b5","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:3.6.5-1:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107496","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.  Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop indefinitely, consuming CPU and resulting in Denial of Service.  CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')  Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group. If the certificate declares a group order of 1, random scalar generation can only produce zero. The key generation routine then retries without limit while waiting for a nonzero private scalar, so the call never returns.  The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are attacker-controlled. Certificates with normal EC group orders do not trigger the loop.  OpenSSL 4.0 and later reject unknown explicit EC groups in default builds. These versions are affected only when configured with the enable-ec_explicit_curves option.  The result is a hang that consumes a CPU core until the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted recipients is unaffected.  The fix makes EC key generation fail when the group has no valid nonzero private scalar, instead of retrying indefinitely.  FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an order-1 group is rejected during key import before the vulnerable key generation path is reached."},"relatedVulnerabilities":[{"id":"CVE-2026-107496","cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached."}]},{"artifact":{"id":"ce8b6147b5899737","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.6.5-1:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/debian/libssl3t64@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107496","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.  Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop indefinitely, consuming CPU and resulting in Denial of Service.  CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')  Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group. If the certificate declares a group order of 1, random scalar generation can only produce zero. The key generation routine then retries without limit while waiting for a nonzero private scalar, so the call never returns.  The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are attacker-controlled. Certificates with normal EC group orders do not trigger the loop.  OpenSSL 4.0 and later reject unknown explicit EC groups in default builds. These versions are affected only when configured with the enable-ec_explicit_curves option.  The result is a hang that consumes a CPU core until the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted recipients is unaffected.  The fix makes EC key generation fail when the group has no valid nonzero private scalar, instead of retrying indefinitely.  FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an order-1 group is rejected during key import before the vulnerable key generation path is reached."},"relatedVulnerabilities":[{"id":"CVE-2026-107496","cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached."}]},{"artifact":{"id":"04ecda1d3ae678e9","cpes":["cpe:2.3:a:openssl:openssl:3.6.5-1:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@3.6.5-1?arch=amd64&distro=debian","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107496","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.  Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop indefinitely, consuming CPU and resulting in Denial of Service.  CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')  Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group. If the certificate declares a group order of 1, random scalar generation can only produce zero. The key generation routine then retries without limit while waiting for a nonzero private scalar, so the call never returns.  The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are attacker-controlled. Certificates with normal EC group orders do not trigger the loop.  OpenSSL 4.0 and later reject unknown explicit EC groups in default builds. These versions are affected only when configured with the enable-ec_explicit_curves option.  The result is a hang that consumes a CPU core until the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted recipients is unaffected.  The fix makes EC key generation fail when the group has no valid nonzero private scalar, instead of retrying indefinitely.  FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an order-1 group is rejected during key import before the vulnerable key generation path is reached."},"relatedVulnerabilities":[{"id":"CVE-2026-107496","cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached."}]},{"artifact":{"id":"e9f205aa14b757fd","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.6.5-1:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.6.5-1:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/debian/openssl-provider-legacy@3.6.5-1?arch=amd64&distro=debian&upstream=openssl","type":"deb","version":"3.6.5-1","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openssl","version":"3.6.5-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107496","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.  Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop indefinitely, consuming CPU and resulting in Denial of Service.  CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')  Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group. If the certificate declares a group order of 1, random scalar generation can only produce zero. The key generation routine then retries without limit while waiting for a nonzero private scalar, so the call never returns.  The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are attacker-controlled. Certificates with normal EC group orders do not trigger the loop.  OpenSSL 4.0 and later reject unknown explicit EC groups in default builds. These versions are affected only when configured with the enable-ec_explicit_curves option.  The result is a hang that consumes a CPU core until the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted recipients is unaffected.  The fix makes EC key generation fail when the group has no valid nonzero private scalar, instead of retrying indefinitely.  FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an order-1 group is rejected during key import before the vulnerable key generation path is reached."},"relatedVulnerabilities":[{"id":"CVE-2026-107496","cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached."}]},{"artifact":{"id":"da9cd667d901a272","cpes":["cpe:2.3:a:libbz2-1.0:libbz2-1.0:1.0.8-6\\+b2:*:*:*:*:*:*:*","cpe:2.3:a:libbz2-1.0:libbz2_1.0:1.0.8-6\\+b2:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2-1.0:1.0.8-6\\+b2:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2_1.0:1.0.8-6\\+b2:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2-1.0:1.0.8-6\\+b2:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2_1.0:1.0.8-6\\+b2:*:*:*:*:*:*:*"],"name":"libbz2-1.0","purl":"pkg:deb/debian/libbz2-1.0@1.0.8-6%2Bb2?arch=amd64&distro=debian&upstream=bzip2%401.0.8-6","type":"deb","version":"1.0.8-6+b2","language":"","licenses":["BSD-variant","GPL-2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbz2-1.0/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libbz2-1.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"bzip2","version":"1.0.8-6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42250","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"bzip2","version":"1.0.8-6"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-42250","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42250","cwe":"CWE-787","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-42250","date":"2026-11-12","epss":0.00126,"percentile":0.02361}],"risk":0.06174,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-42250","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).  This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"},"relatedVulnerabilities":[{"id":"CVE-2026-42250","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42250","cwe":"CWE-787","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-42250","date":"2026-11-12","epss":0.00126,"percentile":0.02361}],"urls":["https://cert.pl/en/posts/2026/05/CVE-2026-42250/","https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/","https://sourceware.org/bzip2/","https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42250","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"}]},{"artifact":{"id":"62a5d35d415a9784","cpes":["cpe:2.3:a:apt:apt:3.3.5:*:*:*:*:*:*:*"],"name":"apt","purl":"pkg:deb/debian/apt@3.3.5?arch=amd64&distro=debian","type":"deb","version":"3.3.5","language":"","licenses":["BSD-3-clause","Expat","GPL-2","GPL-2+","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/apt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.list"},{"path":"/var/lib/dpkg/info/apt.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.postinst"},{"path":"/var/lib/dpkg/info/apt.postrm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.postrm"},{"path":"/var/lib/dpkg/info/apt.preinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.preinst"},{"path":"/var/lib/dpkg/info/apt.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.prerm"},{"path":"/var/lib/dpkg/info/apt.shlibs","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.shlibs"},{"path":"/var/lib/dpkg/info/apt.triggers","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/apt.triggers"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2011-3374","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"apt","version":"3.3.5"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2011-3374","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-3374","cwe":"CWE-347","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3374","date":"2026-11-12","epss":0.01191,"percentile":0.6841}],"risk":0.05955000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-3374","description":"It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack."},"relatedVulnerabilities":[{"id":"CVE-2011-3374","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-3374","cwe":"CWE-347","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3374","date":"2026-11-12","epss":0.01191,"percentile":0.6841}],"urls":["https://access.redhat.com/security/cve/cve-2011-3374","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480","https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html","https://seclists.org/fulldisclosure/2011/Sep/221","https://security-tracker.debian.org/tracker/CVE-2011-3374","https://snyk.io/vuln/SNYK-LINUX-APT-116518","https://ubuntu.com/security/CVE-2011-3374"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-3374","description":"It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack."}]},{"artifact":{"id":"702bf01c1f6f1038","cpes":["cpe:2.3:a:libapt-pkg7.0:libapt-pkg7.0:3.3.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt-pkg7.0:libapt_pkg7.0:3.3.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg7.0:libapt-pkg7.0:3.3.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg7.0:libapt_pkg7.0:3.3.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-pkg7.0:3.3.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_pkg7.0:3.3.5:*:*:*:*:*:*:*"],"name":"libapt-pkg7.0","purl":"pkg:deb/debian/libapt-pkg7.0@3.3.5?arch=amd64&distro=debian&upstream=apt","type":"deb","version":"3.3.5","language":"","licenses":["BSD-3-clause","Expat","GPL-2","GPL-2+","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-pkg7.0/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libapt-pkg7.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-pkg7.0:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libapt-pkg7.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-3374","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"apt","version":"3.3.5"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2011-3374","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-3374","cwe":"CWE-347","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3374","date":"2026-11-12","epss":0.01191,"percentile":0.6841}],"risk":0.05955000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-3374","description":"It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack."},"relatedVulnerabilities":[{"id":"CVE-2011-3374","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-3374","cwe":"CWE-347","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3374","date":"2026-11-12","epss":0.01191,"percentile":0.6841}],"urls":["https://access.redhat.com/security/cve/cve-2011-3374","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480","https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html","https://seclists.org/fulldisclosure/2011/Sep/221","https://security-tracker.debian.org/tracker/CVE-2011-3374","https://snyk.io/vuln/SNYK-LINUX-APT-116518","https://ubuntu.com/security/CVE-2011-3374"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-3374","description":"It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack."}]},{"artifact":{"id":"26f3c0fba3250082","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:262-1:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@262-1?arch=amd64&distro=debian&upstream=systemd","type":"deb","version":"262-1","language":"","licenses":["BSD-3-Clause","CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT-0","Unlicense","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"systemd","version":"262-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-40228","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-12","epss":0.0018,"percentile":0.07631}],"risk":0.05669999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-40228","description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."},"relatedVulnerabilities":[{"id":"CVE-2026-40228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-12","epss":0.0018,"percentile":0.07631}],"urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."}]},{"artifact":{"id":"aacb2ae95582200f","cpes":["cpe:2.3:a:libudev1:libudev1:262-1:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@262-1?arch=amd64&distro=debian&upstream=systemd","type":"deb","version":"262-1","language":"","licenses":["BSD-3-Clause","CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT-0","Unlicense","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"systemd","version":"262-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-40228","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-12","epss":0.0018,"percentile":0.07631}],"risk":0.05669999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-40228","description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."},"relatedVulnerabilities":[{"id":"CVE-2026-40228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-12","epss":0.0018,"percentile":0.07631}],"urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."}]},{"artifact":{"id":"1ceedad7f5af67fe","cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-7:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/debian/tar@1.35%2Bdfsg-7?arch=amd64&distro=debian","type":"deb","version":"1.35+dfsg-7","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18477","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"tar","version":"1.35+dfsg-7"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-18477","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18477","date":"2026-11-12","epss":0.00104,"percentile":0.01005}],"risk":0.04887999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-18477","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue."},"relatedVulnerabilities":[{"id":"CVE-2026-18477","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18477","date":"2026-11-12","epss":0.00104,"percentile":0.01005}],"urls":["https://access.redhat.com/errata/RHSA-2026:49361","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18477","https://bugzilla.redhat.com/show_bug.cgi?id=2509735"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue."}]},{"artifact":{"id":"c50904c94a8e63df","cpes":["cpe:2.3:a:login.defs:login.defs:1\\:4.20.3-1:*:*:*:*:*:*:*"],"name":"login.defs","purl":"pkg:deb/debian/login.defs@1%3A4.20.3-1?arch=all&distro=debian&upstream=shadow","type":"deb","version":"1:4.20.3-1","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login.defs/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/login.defs/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.defs.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.defs.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.defs.postinst"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-5686","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"shadow","version":"1:4.20.3-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2007-5686","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-5686","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2007-5686","date":"2026-11-12","epss":0.00942,"percentile":0.61466}],"risk":0.0471,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2007-5686","description":"initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers."},"relatedVulnerabilities":[{"id":"CVE-2007-5686","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:N/A:N","metrics":{"baseScore":4.9,"impactScore":6.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-5686","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2007-5686","date":"2026-11-12","epss":0.00942,"percentile":0.61466}],"urls":["http://secunia.com/advisories/27215","http://www.securityfocus.com/archive/1/482129/100/100/threaded","http://www.securityfocus.com/archive/1/482857/100/0/threaded","http://www.securityfocus.com/bid/26048","http://www.vupen.com/english/advisories/2007/3474","https://issues.rpath.com/browse/RPL-1825"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-5686","description":"initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers."}]},{"artifact":{"id":"8fdbbe5398eea1c1","cpes":["cpe:2.3:a:passwd:passwd:1\\:4.20.3-1:*:*:*:*:*:*:*"],"name":"passwd","purl":"pkg:deb/debian/passwd@1%3A4.20.3-1?arch=amd64&distro=debian&upstream=shadow","type":"deb","version":"1:4.20.3-1","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-5686","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"shadow","version":"1:4.20.3-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2007-5686","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-5686","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2007-5686","date":"2026-11-12","epss":0.00942,"percentile":0.61466}],"risk":0.0471,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2007-5686","description":"initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers."},"relatedVulnerabilities":[{"id":"CVE-2007-5686","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:N/A:N","metrics":{"baseScore":4.9,"impactScore":6.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-5686","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2007-5686","date":"2026-11-12","epss":0.00942,"percentile":0.61466}],"urls":["http://secunia.com/advisories/27215","http://www.securityfocus.com/archive/1/482129/100/100/threaded","http://www.securityfocus.com/archive/1/482857/100/0/threaded","http://www.securityfocus.com/bid/26048","http://www.vupen.com/english/advisories/2007/3474","https://issues.rpath.com/browse/RPL-1825"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-5686","description":"initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers."}]},{"artifact":{"id":"6c639d2a48be13c9","cpes":["cpe:2.3:a:perl-base:perl-base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.42.3-1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.42.3-1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.42.3-1?arch=amd64&distro=debian&upstream=perl","type":"deb","version":"5.42.3-1","language":"","licenses":["Artistic","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","DRAND48","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-4116","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"perl","version":"5.42.3-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2011-4116","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-4116","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-4116","date":"2026-11-12","epss":0.00524,"percentile":0.44982}],"risk":0.0262,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-4116","description":"_is_safe in the File::Temp module for Perl does not properly handle symlinks."},"relatedVulnerabilities":[{"id":"CVE-2011-4116","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:S/C:N/I:P/A:N","metrics":{"baseScore":1.5,"impactScore":2.9,"exploitabilityScore":2.7},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-4116","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-4116","date":"2026-11-12","epss":0.00524,"percentile":0.44982}],"urls":["http://www.openwall.com/lists/oss-security/2011/11/04/2","http://www.openwall.com/lists/oss-security/2011/11/04/4","https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14","https://rt.cpan.org/Public/Bug/Display.html?id=69106","https://seclists.org/oss-sec/2011/q4/238"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-4116","description":"_is_safe in the File::Temp module for Perl does not properly handle symlinks."}]},{"artifact":{"id":"38948bfd6e1d2bb5","cpes":["cpe:2.3:a:curl:curl:8.22.0-1:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@8.22.0-1?arch=amd64&distro=debian","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-12","epss":0.0051,"percentile":0.43991}],"risk":0.025500000000000002,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key."},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-12","epss":0.0051,"percentile":0.43991}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"30d9d5e8b034a30a","cpes":["cpe:2.3:a:libcurl4t64:libcurl4t64:8.22.0-1:*:*:*:*:*:*:*"],"name":"libcurl4t64","purl":"pkg:deb/debian/libcurl4t64@8.22.0-1?arch=amd64&distro=debian&upstream=curl","type":"deb","version":"8.22.0-1","language":"","licenses":["BSD-3-Clause","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3+","ISC","OLDAP-2.8","X11","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4t64/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libcurl4t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libcurl4t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0~rc1-1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0~rc1-1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"curl","version":"8.22.0-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0~rc1-1"],"available":[{"date":"2026-10-15","kind":"first-observed","version":"8.23.0~rc1-1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-12","epss":0.0051,"percentile":0.43991}],"risk":0.025500000000000002,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key."},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-12","epss":0.0051,"percentile":0.43991}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"26f3c0fba3250082","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:262-1:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@262-1?arch=amd64&distro=debian&upstream=systemd","type":"deb","version":"262-1","language":"","licenses":["BSD-3-Clause","CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT-0","Unlicense","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2013-4392","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"systemd","version":"262-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2013-4392","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2013-4392","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2013-4392","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2013-4392","date":"2026-11-12","epss":0.00468,"percentile":0.40999}],"risk":0.0234,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2013-4392","description":"systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files."},"relatedVulnerabilities":[{"id":"CVE-2013-4392","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":3.3,"impactScore":5,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2013-4392","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2013-4392","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2013-4392","date":"2026-11-12","epss":0.00468,"percentile":0.40999}],"urls":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357","http://www.openwall.com/lists/oss-security/2013/10/01/9","https://bugzilla.redhat.com/show_bug.cgi?id=859060"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2013-4392","description":"systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files."}]},{"artifact":{"id":"aacb2ae95582200f","cpes":["cpe:2.3:a:libudev1:libudev1:262-1:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@262-1?arch=amd64&distro=debian&upstream=systemd","type":"deb","version":"262-1","language":"","licenses":["BSD-3-Clause","CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT-0","Unlicense","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2013-4392","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"systemd","version":"262-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2013-4392","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2013-4392","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2013-4392","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2013-4392","date":"2026-11-12","epss":0.00468,"percentile":0.40999}],"risk":0.0234,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2013-4392","description":"systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files."},"relatedVulnerabilities":[{"id":"CVE-2013-4392","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":3.3,"impactScore":5,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2013-4392","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2013-4392","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2013-4392","date":"2026-11-12","epss":0.00468,"percentile":0.40999}],"urls":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357","http://www.openwall.com/lists/oss-security/2013/10/01/9","https://bugzilla.redhat.com/show_bug.cgi?id=859060"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2013-4392","description":"systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files."}]},{"artifact":{"id":"1a46219bbfecd0d2","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.42.4-1:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/debian/bsdutils@1%3A2.42.4-1?arch=amd64&distro=debian&upstream=util-linux%402.42.4-1","type":"deb","version":"1:2.42.4-1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.42.4-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0563","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"util-linux","version":"2.42.4-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2022-0563","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"risk":0.021500000000000002,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."},"relatedVulnerabilities":[{"id":"CVE-2022-0563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"urls":["https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u","https://security.gentoo.org/glsa/202401-08","https://security.netapp.com/advisory/ntap-20220331-0002/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."}]},{"artifact":{"id":"33dee3c0ce872fce","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.42.4-1:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/debian/libblkid1@2.42.4-1?arch=amd64&distro=debian&upstream=util-linux","type":"deb","version":"2.42.4-1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0563","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"util-linux","version":"2.42.4-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2022-0563","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"risk":0.021500000000000002,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."},"relatedVulnerabilities":[{"id":"CVE-2022-0563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"urls":["https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u","https://security.gentoo.org/glsa/202401-08","https://security.netapp.com/advisory/ntap-20220331-0002/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."}]},{"artifact":{"id":"91997b2e2779578c","cpes":["cpe:2.3:a:libmount1:libmount1:2.42.4-1:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/debian/libmount1@2.42.4-1?arch=amd64&distro=debian&upstream=util-linux","type":"deb","version":"2.42.4-1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0563","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"util-linux","version":"2.42.4-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2022-0563","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"risk":0.021500000000000002,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."},"relatedVulnerabilities":[{"id":"CVE-2022-0563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"urls":["https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u","https://security.gentoo.org/glsa/202401-08","https://security.netapp.com/advisory/ntap-20220331-0002/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."}]},{"artifact":{"id":"9899773ae2e38ef5","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.42.4-1:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/debian/libsmartcols1@2.42.4-1?arch=amd64&distro=debian&upstream=util-linux","type":"deb","version":"2.42.4-1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0563","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"util-linux","version":"2.42.4-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2022-0563","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"risk":0.021500000000000002,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."},"relatedVulnerabilities":[{"id":"CVE-2022-0563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"urls":["https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u","https://security.gentoo.org/glsa/202401-08","https://security.netapp.com/advisory/ntap-20220331-0002/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."}]},{"artifact":{"id":"46e7dc6866aa0701","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.42.4-1:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/debian/libuuid1@2.42.4-1?arch=amd64&distro=debian&upstream=util-linux","type":"deb","version":"2.42.4-1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0563","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"util-linux","version":"2.42.4-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2022-0563","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"risk":0.021500000000000002,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."},"relatedVulnerabilities":[{"id":"CVE-2022-0563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"urls":["https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u","https://security.gentoo.org/glsa/202401-08","https://security.netapp.com/advisory/ntap-20220331-0002/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."}]},{"artifact":{"id":"93650c8087fb6460","cpes":["cpe:2.3:a:login:login:1\\:4.16.0-2\\+really2.42.4-1:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.42.4-1?arch=amd64&distro=debian&upstream=util-linux%402.42.4-1","type":"deb","version":"1:4.16.0-2+really2.42.4-1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.defs.conffiles"},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.defs.md5sums"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.defs.postinst"},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"util-linux","version":"2.42.4-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0563","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"util-linux","version":"2.42.4-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2022-0563","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"risk":0.021500000000000002,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."},"relatedVulnerabilities":[{"id":"CVE-2022-0563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"urls":["https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u","https://security.gentoo.org/glsa/202401-08","https://security.netapp.com/advisory/ntap-20220331-0002/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."}]},{"artifact":{"id":"e5a626149bba85e0","cpes":["cpe:2.3:a:mount:mount:2.42.4-1:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/debian/mount@2.42.4-1?arch=amd64&distro=debian&upstream=util-linux","type":"deb","version":"2.42.4-1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0563","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"util-linux","version":"2.42.4-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2022-0563","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"risk":0.021500000000000002,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."},"relatedVulnerabilities":[{"id":"CVE-2022-0563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"urls":["https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u","https://security.gentoo.org/glsa/202401-08","https://security.netapp.com/advisory/ntap-20220331-0002/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."}]},{"artifact":{"id":"e1cc1089a8586a6d","cpes":["cpe:2.3:a:util-linux:util-linux:2.42.4-1:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.42.4-1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.42.4-1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.42.4-1:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.42.4-1:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.42.4-1:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/debian/util-linux@2.42.4-1?arch=amd64&distro=debian","type":"deb","version":"2.42.4-1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-0563","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"util-linux","version":"2.42.4-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2022-0563","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"risk":0.021500000000000002,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."},"relatedVulnerabilities":[{"id":"CVE-2022-0563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0563","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0563","date":"2026-11-12","epss":0.0043,"percentile":0.37733}],"urls":["https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u","https://security.gentoo.org/glsa/202401-08","https://security.netapp.com/advisory/ntap-20220331-0002/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0563","description":"A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."}]},{"artifact":{"id":"1b825b249b1ebaeb","cpes":["cpe:2.3:a:gcc-16-base:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16-base:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16_base:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16_base:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-16:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_16:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-16-base:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_16_base:16.2.0-3:*:*:*:*:*:*:*"],"name":"gcc-16-base","purl":"pkg:deb/debian/gcc-16-base@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/gcc-16-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-16-base:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/gcc-16-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-115455","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"risk":0.019350000000000003,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-115455","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"urls":["https://access.redhat.com/errata/RHSA-2026:94989","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-115455","https://bugzilla.redhat.com/show_bug.cgi?id=2562933","https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}]},{"artifact":{"id":"8520c2979cc4e2cf","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:16.2.0-3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:16.2.0-3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-115455","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"risk":0.019350000000000003,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-115455","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"urls":["https://access.redhat.com/errata/RHSA-2026:94989","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-115455","https://bugzilla.redhat.com/show_bug.cgi?id=2562933","https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}]},{"artifact":{"id":"d4533c669aff8d23","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:16.2.0-3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@16.2.0-3?arch=amd64&distro=debian&upstream=gcc-16","type":"deb","version":"16.2.0-3","language":"","licenses":["sha256:e45db18266750eacd5a728542c8ef53b00e3348aa1b0191de5f52a3ee8e2a6ba"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-16-base/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-16"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"gcc-16","version":"16.2.0-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-115455","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"risk":0.019350000000000003,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-115455","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"urls":["https://access.redhat.com/errata/RHSA-2026:94989","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-115455","https://bugzilla.redhat.com/show_bug.cgi?id=2562933","https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}]},{"artifact":{"id":"26f3c0fba3250082","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:262-1:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@262-1?arch=amd64&distro=debian&upstream=systemd","type":"deb","version":"262-1","language":"","licenses":["BSD-3-Clause","CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT-0","Unlicense","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31439","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"systemd","version":"262-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2023-31439","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31439","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-31439","date":"2026-11-12","epss":0.00349,"percentile":0.28966}],"risk":0.01745,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-31439","description":"An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""},"relatedVulnerabilities":[{"id":"CVE-2023-31439","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31439","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-31439","date":"2026-11-12","epss":0.00349,"percentile":0.28966}],"urls":["https://github.com/kastel-security/Journald","https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf","https://github.com/systemd/systemd/pull/28885","https://github.com/systemd/systemd/releases"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31439","description":"An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""}]},{"artifact":{"id":"aacb2ae95582200f","cpes":["cpe:2.3:a:libudev1:libudev1:262-1:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@262-1?arch=amd64&distro=debian&upstream=systemd","type":"deb","version":"262-1","language":"","licenses":["BSD-3-Clause","CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT-0","Unlicense","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31439","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"systemd","version":"262-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2023-31439","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31439","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-31439","date":"2026-11-12","epss":0.00349,"percentile":0.28966}],"risk":0.01745,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-31439","description":"An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""},"relatedVulnerabilities":[{"id":"CVE-2023-31439","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31439","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-31439","date":"2026-11-12","epss":0.00349,"percentile":0.28966}],"urls":["https://github.com/kastel-security/Journald","https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf","https://github.com/systemd/systemd/pull/28885","https://github.com/systemd/systemd/releases"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31439","description":"An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""}]},{"artifact":{"id":"ee1fb93e1790b636","cpes":["cpe:2.3:a:libldap2:libldap2:2.6.14\\+dfsg-2:*:*:*:*:*:*:*"],"name":"libldap2","purl":"pkg:deb/debian/libldap2@2.6.14%2Bdfsg-2?arch=amd64&distro=debian&upstream=openldap","type":"deb","version":"2.6.14+dfsg-2","language":"","licenses":["BSD-3-clause","BSD-3-clause-California","BSD-3-clause-variant","BSD-4-clause-California","Beerware","Expat","Expat-ISC","Expat-UNM","F5","FSF-unlimited","GPL-2","GPL-2+","GPL-3","GPL-3+","JCG","MIT-XC","NeoSoft-permissive","OpenLDAP-2.8","UMich","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libldap2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libldap2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-14159","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openldap","version":"2.6.14+dfsg-2"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2017-14159","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-14159","cwe":"CWE-665","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14159","date":"2026-11-12","epss":0.00346,"percentile":0.28597}],"risk":0.0173,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14159","description":"slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript."},"relatedVulnerabilities":[{"id":"CVE-2017-14159","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14159","cwe":"CWE-665","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14159","date":"2026-11-12","epss":0.00346,"percentile":0.28597}],"urls":["http://www.openldap.org/its/index.cgi?findid=8703","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14159","description":"slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript."}]},{"artifact":{"id":"6375ccc856af23fe","cpes":["cpe:2.3:a:coreutils:coreutils:9.10-1:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:deb/debian/coreutils@9.10-1?arch=amd64&distro=debian","type":"deb","version":"9.10-1","language":"","licenses":["BSD-4-clause-UC","FSFULLR","GFDL-1.3","GFDL-NIV-1.3","GPL-3","GPL-3+","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/coreutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-18018","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"coreutils","version":"9.10-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2017-18018","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-18018","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-18018","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-18018","date":"2026-11-12","epss":0.00345,"percentile":0.285}],"risk":0.01725,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-18018","description":"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition."},"relatedVulnerabilities":[{"id":"CVE-2017-18018","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-18018","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-18018","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-18018","date":"2026-11-12","epss":0.00345,"percentile":0.285}],"urls":["http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-18018","description":"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition."}]},{"artifact":{"id":"26f3c0fba3250082","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:262-1:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@262-1?arch=amd64&distro=debian&upstream=systemd","type":"deb","version":"262-1","language":"","licenses":["BSD-3-Clause","CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT-0","Unlicense","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31437","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"systemd","version":"262-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2023-31437","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31437","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31437","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31437","date":"2026-11-12","epss":0.00341,"percentile":0.28034}],"risk":0.01705,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-31437","description":"An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""},"relatedVulnerabilities":[{"id":"CVE-2023-31437","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31437","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31437","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31437","date":"2026-11-12","epss":0.00341,"percentile":0.28034}],"urls":["https://github.com/kastel-security/Journald","https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf","https://github.com/systemd/systemd/releases"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31437","description":"An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""}]},{"artifact":{"id":"aacb2ae95582200f","cpes":["cpe:2.3:a:libudev1:libudev1:262-1:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@262-1?arch=amd64&distro=debian&upstream=systemd","type":"deb","version":"262-1","language":"","licenses":["BSD-3-Clause","CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT-0","Unlicense","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31437","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"systemd","version":"262-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2023-31437","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31437","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31437","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31437","date":"2026-11-12","epss":0.00341,"percentile":0.28034}],"risk":0.01705,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-31437","description":"An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""},"relatedVulnerabilities":[{"id":"CVE-2023-31437","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31437","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31437","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31437","date":"2026-11-12","epss":0.00341,"percentile":0.28034}],"urls":["https://github.com/kastel-security/Journald","https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf","https://github.com/systemd/systemd/releases"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31437","description":"An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""}]},{"artifact":{"id":"26f3c0fba3250082","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:262-1:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@262-1?arch=amd64&distro=debian&upstream=systemd","type":"deb","version":"262-1","language":"","licenses":["BSD-3-Clause","CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT-0","Unlicense","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31438","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"systemd","version":"262-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2023-31438","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31438","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-31438","date":"2026-11-12","epss":0.00325,"percentile":0.2594}],"risk":0.01625,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-31438","description":"An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""},"relatedVulnerabilities":[{"id":"CVE-2023-31438","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31438","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-31438","date":"2026-11-12","epss":0.00325,"percentile":0.2594}],"urls":["https://github.com/kastel-security/Journald","https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf","https://github.com/systemd/systemd/pull/28886","https://github.com/systemd/systemd/releases"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31438","description":"An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""}]},{"artifact":{"id":"aacb2ae95582200f","cpes":["cpe:2.3:a:libudev1:libudev1:262-1:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@262-1?arch=amd64&distro=debian&upstream=systemd","type":"deb","version":"262-1","language":"","licenses":["BSD-3-Clause","CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT-0","Unlicense","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31438","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"systemd","version":"262-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2023-31438","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31438","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-31438","date":"2026-11-12","epss":0.00325,"percentile":0.2594}],"risk":0.01625,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-31438","description":"An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""},"relatedVulnerabilities":[{"id":"CVE-2023-31438","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31438","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-31438","date":"2026-11-12","epss":0.00325,"percentile":0.2594}],"urls":["https://github.com/kastel-security/Journald","https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf","https://github.com/systemd/systemd/pull/28886","https://github.com/systemd/systemd/releases"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31438","description":"An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""}]},{"artifact":{"id":"6375ccc856af23fe","cpes":["cpe:2.3:a:coreutils:coreutils:9.10-1:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:deb/debian/coreutils@9.10-1?arch=amd64&distro=debian","type":"deb","version":"9.10-1","language":"","licenses":["BSD-4-clause-UC","FSFULLR","GFDL-1.3","GFDL-NIV-1.3","GPL-3","GPL-3+","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/coreutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5278","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"coreutils","version":"9.10-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2025-5278","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-5278","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5278","date":"2026-11-12","epss":0.0031,"percentile":0.24169}],"risk":0.0155,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-5278","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data."},"relatedVulnerabilities":[{"id":"CVE-2025-5278","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5278","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5278","date":"2026-11-12","epss":0.0031,"percentile":0.24169}],"urls":["https://access.redhat.com/errata/RHSA-2026:28911","https://access.redhat.com/errata/RHSA-2026:33124","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:33612","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:46836","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:69964","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2025-5278","https://bugzilla.redhat.com/show_bug.cgi?id=2368764","https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507","http://www.openwall.com/lists/oss-security/2025/05/27/2","http://www.openwall.com/lists/oss-security/2025/05/29/1","http://www.openwall.com/lists/oss-security/2025/05/29/2","https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14","https://security-tracker.debian.org/tracker/CVE-2025-5278"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5278","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data."}]},{"artifact":{"id":"1929bc7ef736872d","cpes":["cpe:2.3:a:diffutils:diffutils:1\\:3.12-1:*:*:*:*:*:*:*"],"name":"diffutils","purl":"pkg:deb/debian/diffutils@1%3A3.12-1?arch=amd64&distro=debian","type":"deb","version":"1:3.12-1","language":"","licenses":["FSFAP","FSFULLR","GFDL-1.3","GFDL-NIV-1.3","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3.0+","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/diffutils/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/diffutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/diffutils.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/diffutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/diffutils.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/diffutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"diffutils","version":"1:3.12-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-53910","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53910","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-53910","date":"2026-11-12","epss":0.00291,"percentile":0.22007}],"risk":0.014549999999999999,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-53910","description":"diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.   This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815   NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges."},"relatedVulnerabilities":[{"id":"CVE-2026-53910","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53910","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-53910","date":"2026-11-12","epss":0.00291,"percentile":0.22007}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-53910","https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50","https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815","https://git.savannah.gnu.org/cgit/diffutils.git/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53910","description":"diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds.\nWhen processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing. \nAn attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.\n\n\nThis issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815 \n\nNOTE:\nThe project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges."}]},{"artifact":{"id":"6375ccc856af23fe","cpes":["cpe:2.3:a:coreutils:coreutils:9.10-1:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:deb/debian/coreutils@9.10-1?arch=amd64&distro=debian","type":"deb","version":"9.10-1","language":"","licenses":["BSD-4-clause-UC","FSFULLR","GFDL-1.3","GFDL-NIV-1.3","GPL-3","GPL-3+","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/coreutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56392","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"coreutils","version":"9.10-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.009300000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.  When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.           This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[{"id":"CVE-2026-56392","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"}]},{"artifact":{"id":"ee1fb93e1790b636","cpes":["cpe:2.3:a:libldap2:libldap2:2.6.14\\+dfsg-2:*:*:*:*:*:*:*"],"name":"libldap2","purl":"pkg:deb/debian/libldap2@2.6.14%2Bdfsg-2?arch=amd64&distro=debian&upstream=openldap","type":"deb","version":"2.6.14+dfsg-2","language":"","licenses":["BSD-3-clause","BSD-3-clause-California","BSD-3-clause-variant","BSD-4-clause-California","Beerware","Expat","Expat-ISC","Expat-UNM","F5","FSF-unlimited","GPL-2","GPL-2+","GPL-3","GPL-3+","JCG","MIT-XC","NeoSoft-permissive","OpenLDAP-2.8","UMich","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libldap2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libldap2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-22185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"openldap","version":"2.6.14+dfsg-2"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-22185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-22185","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-22185","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-22185","date":"2026-11-12","epss":0.00152,"percentile":0.04401}],"risk":0.007600000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-22185","description":"OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition."},"relatedVulnerabilities":[{"id":"CVE-2026-22185","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22185","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-22185","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-22185","date":"2026-11-12","epss":0.00152,"percentile":0.04401}],"urls":["https://bugs.openldap.org/show_bug.cgi?id=10421","https://seclists.org/fulldisclosure/2026/Jan/5","https://seclists.org/fulldisclosure/2026/Jan/8","https://www.openldap.org/","https://www.vulncheck.com/advisories/openldap-lmdb-mdb-load-heap-buffer-underflow-in-readline"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22185","description":"OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition."}]},{"artifact":{"id":"6375ccc856af23fe","cpes":["cpe:2.3:a:coreutils:coreutils:9.10-1:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:deb/debian/coreutils@9.10-1?arch=amd64&distro=debian","type":"deb","version":"9.10-1","language":"","licenses":["BSD-4-clause-UC","FSFULLR","GFDL-1.3","GFDL-NIV-1.3","GPL-3","GPL-3+","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/coreutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"coreutils","version":"9.10-1"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.00655,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value.  This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.  When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.   This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[{"id":"CVE-2026-56391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."}]},{"artifact":{"id":"e919b2d690c3a4f3","cpes":["cpe:2.3:a:dash:dash:0.5.12-12:*:*:*:*:*:*:*"],"name":"dash","purl":"pkg:deb/debian/dash@0.5.12-12?arch=amd64&distro=debian","type":"deb","version":"0.5.12-12","language":"","licenses":["BSD-3-Clause","BSD-3-clause","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.list"},{"path":"/var/lib/dpkg/info/dash.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.postinst"},{"path":"/var/lib/dpkg/info/dash.postrm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.postrm"},{"path":"/var/lib/dpkg/info/dash.preinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.preinst"},{"path":"/var/lib/dpkg/info/dash.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.prerm"},{"path":"/var/lib/dpkg/info/dash.templates","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.templates"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102474","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"dash","version":"0.5.12-12"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-102474","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102474","date":"2026-11-12","epss":0.00113,"percentile":0.01429}],"risk":0.00565,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102474","description":"A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \\u or \\U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation."},"relatedVulnerabilities":[{"id":"CVE-2026-102474","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102474","date":"2026-11-12","epss":0.00113,"percentile":0.01429}],"urls":["https://access.redhat.com/security/cve/CVE-2026-102474","https://bugzilla.redhat.com/show_bug.cgi?id=2543004"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102474","description":"A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \\u or \\U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation."}]},{"artifact":{"id":"e919b2d690c3a4f3","cpes":["cpe:2.3:a:dash:dash:0.5.12-12:*:*:*:*:*:*:*"],"name":"dash","purl":"pkg:deb/debian/dash@0.5.12-12?arch=amd64&distro=debian","type":"deb","version":"0.5.12-12","language":"","licenses":["BSD-3-Clause","BSD-3-clause","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.list"},{"path":"/var/lib/dpkg/info/dash.postinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.postinst"},{"path":"/var/lib/dpkg/info/dash.postrm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.postrm"},{"path":"/var/lib/dpkg/info/dash.preinst","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.preinst"},{"path":"/var/lib/dpkg/info/dash.prerm","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.prerm"},{"path":"/var/lib/dpkg/info/dash.templates","layerID":"sha256:34059b70d43085c65d25dd103e73d29ea87d131e42a743d9be9c1a42719995a9","accessPath":"/var/lib/dpkg/info/dash.templates"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"dash","version":"0.5.12-12"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-102473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102473","date":"2026-11-12","epss":0.00102,"percentile":0.00931}],"risk":0.0051,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102473","description":"A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-102473","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102473","date":"2026-11-12","epss":0.00102,"percentile":0.00931}],"urls":["https://access.redhat.com/security/cve/CVE-2026-102473","https://bugzilla.redhat.com/show_bug.cgi?id=2543005"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102473","description":"A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU."}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107364","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107364","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107364"},"relatedVulnerabilities":[{"id":"CVE-2026-107364","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107884","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107884","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107884"},"relatedVulnerabilities":[{"id":"CVE-2026-107884","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111423","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-111423","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-111423"},"relatedVulnerabilities":[{"id":"CVE-2026-111423","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-118380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-118380"},"relatedVulnerabilities":[{"id":"CVE-2026-118380","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-71199","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-71199","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-71199"},"relatedVulnerabilities":[{"id":"CVE-2026-71199","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"d249beb11f885479","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-71200","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-71200","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-71200"},"relatedVulnerabilities":[{"id":"CVE-2026-71200","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107364","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107364","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107364"},"relatedVulnerabilities":[{"id":"CVE-2026-107364","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107884","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107884","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107884"},"relatedVulnerabilities":[{"id":"CVE-2026-107884","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111423","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-111423","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-111423"},"relatedVulnerabilities":[{"id":"CVE-2026-111423","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-118380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-118380"},"relatedVulnerabilities":[{"id":"CVE-2026-118380","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-71199","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-71199","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-71199"},"relatedVulnerabilities":[{"id":"CVE-2026-71199","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"cf50314958384ae1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-71200","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-71200","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-71200"},"relatedVulnerabilities":[{"id":"CVE-2026-71200","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107364","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107364","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107364"},"relatedVulnerabilities":[{"id":"CVE-2026-107364","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107884","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107884","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107884"},"relatedVulnerabilities":[{"id":"CVE-2026-107884","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111423","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-111423","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-111423"},"relatedVulnerabilities":[{"id":"CVE-2026-111423","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-118380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-118380"},"relatedVulnerabilities":[{"id":"CVE-2026-118380","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-71199","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-71199","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-71199"},"relatedVulnerabilities":[{"id":"CVE-2026-71199","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ec8a4905fa61cd25","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-71200","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-71200","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-71200"},"relatedVulnerabilities":[{"id":"CVE-2026-71200","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107364","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107364","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107364"},"relatedVulnerabilities":[{"id":"CVE-2026-107364","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107884","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-107884","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107884"},"relatedVulnerabilities":[{"id":"CVE-2026-107884","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111423","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-111423","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-111423"},"relatedVulnerabilities":[{"id":"CVE-2026-111423","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-118380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-118380"},"relatedVulnerabilities":[{"id":"CVE-2026-118380","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-71199","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-71199","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-71199"},"relatedVulnerabilities":[{"id":"CVE-2026-71199","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ac27a00c1a045150","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.22.1-3?arch=amd64&distro=debian&upstream=krb5","type":"deb","version":"1.22.1-3","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:83991a09875eb8fc63c3fdee4df4afef2aef425b7de66b816a9d36671bca0e5e","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-71200","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"forky"},"package":{"name":"krb5","version":"1.22.1-3"},"namespace":"debian:distro:debian:unstable"}}],"vulnerability":{"id":"CVE-2026-71200","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"debian:distro:debian:unstable","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-71200"},"relatedVulnerabilities":[{"id":"CVE-2026-71200","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]}],"grade":"F","score":"0.00","as_of":"2026-11-14T03:48:40.482Z","grype_db_version":"2026-11-13T15:40:34.000Z"}