{"grype_matches":[{"artifact":{"id":"cc74bfdd2850086b","cpes":["cpe:2.3:a:php8.5:php8.5:8.5.4-0ubuntu1.5:*:*:*:*:*:*:*"],"name":"php8.5","purl":"pkg:deb/ubuntu/php8.5@8.5.4-0ubuntu1.5?distro=ubuntu","type":"deb","version":"8.5.4-0ubuntu1.5","language":"","licenses":[],"locations":[{"path":"/usr/bin/php8.5","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/bin/php8.5","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/calendar.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/calendar.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/ctype.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/ctype.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/exif.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/exif.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/ffi.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/ffi.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/fileinfo.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/fileinfo.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/ftp.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/ftp.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/gettext.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/gettext.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/iconv.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/iconv.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/pdo.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/pdo.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/phar.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/phar.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/posix.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/posix.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/shmop.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/shmop.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/sockets.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/sockets.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/sysvmsg.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/sysvmsg.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/sysvsem.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/sysvsem.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/sysvshm.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/sysvshm.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/php/20250925/tokenizer.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/php/20250925/tokenizer.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"php8.5","version":"8.5.4-0ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-11-12","epss":0.00368,"percentile":0.31064}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-11-12","epss":0.00368,"percentile":0.31064}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"5c2c4db26d4ad61c","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?distro=ubuntu","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libssl.so.3","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/libssl.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95692","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95692","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"risk":0.1055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95692"},"relatedVulnerabilities":[{"id":"CVE-2026-95692","cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"urls":["https://github.com/openssl/openssl/commit/257a3427aa0ef8d9dd2ef5b3e2d1c021a221b116","https://github.com/openssl/openssl/commit/510872388f5d145cf870868b3d288a23822cb776","https://github.com/openssl/openssl/commit/70a47ac78b6f3be1b22fb1551bd0bfcff4f29613","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce\nlength via EVP_CipherInit_ex() may trigger a heap out-of-bounds read.\nSupplying a longer IV is silently truncated instead of rejected.\n\nImpact summary: An application passing a caller-supplied IV of the wrong\nlength may crash or read beyond its buffer. Because trailing IV bytes are\nignored, an attacker who knows one message and tag may forge messages under a\ndifferent IV.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: AES-GCM-SIV copies the caller-supplied IV or nonce into its\ninternal state using a copy whose length is taken from the expected nonce size\nrather than from the length the caller actually provided. When the caller\npasses a shorter IV, the copy reads past the end of the caller's buffer;\nAddressSanitizer confirms a heap out-of-bounds read reached through\nEVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a\nlonger IV, the implementation silently discards the trailing bytes instead of\nrejecting the length.\n\nThe truncation breaks the binding between the IV and the computed\nauthentication tag. An attacker who has observed a message and its tag under\none IV can produce a message and tag that verify under a different IV whose\nfirst bytes match, since the surplus bytes never influence the computation.\nThe message itself is unchanged, so this is a failure of IV commitment rather\nthan a classic existential forgery.\n\nOnly applications that call EVP_CipherInit_ex() (or the equivalent provider\ncipher initialization) with an IV length other than the standard 12 bytes for\nAES-GCM-SIV are affected. The severity is limited because the out-of-bounds\nread is small and attacker-controlled only in length, and the forgery requires\nan unusual IV length choice by the application.\n\nFIPS impact: no\nThe FIPS modules are not affected by this issue, as AES-GCM-SIV is not an\napproved algorithm."}]},{"artifact":{"id":"5c2c4db26d4ad61c","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?distro=ubuntu","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libssl.so.3","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/libssl.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-88822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"risk":0.095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88822"},"relatedVulnerabilities":[{"id":"CVE-2026-88822","cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"urls":["https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75","https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88","https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow\nuninitialized stack data to leak into the received address which is then used\nas the destination for outgoing packets.\n\nImpact summary: Applications using QUIC's automated peer detection mechanism\nmay receive an invalid address, leading to connection loss and disclosure of\nuninitialized stack data to an attacker observing the outgoing network traffic.\n\nCWE: CWE-457 (Use of Uninitialized Variable)\n\nDescription: The OpenSSL QUIC stack contains a feature in which, when using an\nalready connected socket, it will auto-detect the peer address during the SSL\nhandshake.  This feature uses the getpeername() function, passing a buffer of\nsufficient length to hold any supported address family, but passes a buffer\nlength that is only sized such that larger addresses, such as IPv6, cannot be\nretrieved. The getpeername() function however, still returns the full address\nlength, which is accepted as the valid input buffer length, leading to the\naddress buffer containing uninitialized stack data instead of the actual peer\naddress. The invalid peer address is then used as destination for the outgoing\npackets which leads to a connectivity breakage and a leakage of the\nuninitialized stack data to passive network observers.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as\nthe affected protocol is not implemented in the FIPS module."}]},{"artifact":{"id":"5c2c4db26d4ad61c","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?distro=ubuntu","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libssl.so.3","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/libssl.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"risk":0.095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95691"},"relatedVulnerabilities":[{"id":"CVE-2026-95691","cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"urls":["https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"f19767660d7ddb63","cpes":["cpe:2.3:a:golang:go:1.27.3:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.3","type":"go-module","version":"go1.27.3","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.3"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6859","versionConstraint":"<1.26.11||>=1.27.0-0,<1.27.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.3"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6859","fix":{"state":"fixed","versions":["1.26.11","1.27.4"],"available":[{"date":"2026-11-10","kind":"release","version":"1.26.11"},{"date":"2026-11-10","kind":"release","version":"1.27.4"}]},"cvss":[],"epss":[{"cve":"CVE-2026-97054","date":"2026-11-12","epss":0.00171,"percentile":0.0656}],"risk":0.08549999999999999,"urls":["https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/862185","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header."},"relatedVulnerabilities":[{"id":"CVE-2026-97054","cvss":[],"epss":[{"cve":"CVE-2026-97054","date":"2026-11-12","epss":0.00171,"percentile":0.0656}],"urls":["https://go.dev/cl/862185","https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM","https://pkg.go.dev/vuln/GO-2026-6859"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97054","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header."}]},{"artifact":{"id":"5c2c4db26d4ad61c","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?distro=ubuntu","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libssl.so.3","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/libssl.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-88823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88823"},"relatedVulnerabilities":[{"id":"CVE-2026-88823","cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"urls":["https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4","https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682","https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}]},{"artifact":{"id":"5c2c4db26d4ad61c","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?distro=ubuntu","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libssl.so.3","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/libssl.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107496","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107496"},"relatedVulnerabilities":[{"id":"CVE-2026-107496","cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached."}]},{"artifact":{"id":"36b88414fd82f8f2","cpes":["cpe:2.3:a:libxml2:libxml2:2.15.2\\+dfsg-0.1ubuntu0.3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/ubuntu/libxml2@2.15.2%2Bdfsg-0.1ubuntu0.3?distro=ubuntu","type":"deb","version":"2.15.2+dfsg-0.1ubuntu0.3","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libxml2.so.16.1.2","layerID":"sha256:ef9b64f7a4837d101683dc24bb04412ddff851ceab68b5bdeffe60f937473d8f","accessPath":"/usr/lib/x86_64-linux-gnu/libxml2.so.16.1.2","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11979","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libxml2","version":"2.15.2+dfsg-0.1ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-11979","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11979","cwe":"CWE-121","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-11979","date":"2026-11-12","epss":0.00148,"percentile":0.04091}],"risk":0.007400000000000001,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11979"},"relatedVulnerabilities":[{"id":"CVE-2026-11979","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11979","cwe":"CWE-121","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-11979","date":"2026-11-12","epss":0.00148,"percentile":0.04091}],"urls":["https://cert.pl/en/posts/2026/06/CVE-2026-11979","https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11979","description":"libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.\nBy supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.\nSuccessful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.\n\nThis issue has been fixed in the commit c2e233fc.\n\nNOTE:\nThe maintainers of this project did not agree that this issue is a vulnerability and considered it a bug."}]}],"grade":"A","score":"100.00","as_of":"2026-11-14T07:56:29.837Z","grype_db_version":"2026-11-13T15:40:34.000Z"}